GitHub
Source integration to GitHub, the developer platform.
Personal Access Tokens (classic) should be created with the following scopes: repo, gist, and read:org. (Fine-grained tokens are not supported.)
Key | Description | Required |
endpoint | Endpoint for accessing GitHub. Omitting it will use GitHub cloud. | No |
repositories | List of repositories to be included in the scan. Omitting this will enumerate instead (recommended). | No |
organizations | List of organizations to be included in the scan. Omitting this will enumerate instead (recommended). | No |
scanUsers | Enumerate organization members and scan their public repositories | No |
includeForks | Whether to include forked repositories in the scan | No |
head | The name of the branch to be used as the head | No |
base | The name of the branch to be used as the base | No |
ignoreRepos | List of repositories to be excluded from the scan | No |
includeRepos | List of repositories to be specifically included in the scan | No |
includePullRequestComments | Whether to include pull request comments in the scan | No |
includeIssueComments | Whether to include issue comments in the scan | No |
includeGistComments | Whether to include gist comments in the scan | No |
skipBinaries | Whether to exclude binary files from the scan | No |
skipArchives | Whether to exclude archive files from the scan | No |
includeWikis | Whether to include wikis in the scan | No |
Feature | Supported |
Scan archive files | ✅ |
Scan archived repositories | ✅ |
Scan base64 encoded data | ✅ |
Scan binaries | ✅ |
Comments | ✅ |
Gists | ✅ |
Include/Exclude Filter | ✅ |
Forks | ✅ |
History | ✅ |
Pre-commit | ✅ |
Pre-receive | ✅ |
Real time scanning | ❌ |
Auto resume | ✅ |
Version history | ✅ |
Scan in Continuous Integration (CI) | ✅ |
Notes:
- TruffleHog does not scan diffs greater than 1 GB.
- Scanning in GitHub Actions is supported but requires additional setup.
- When creating a personal access token, make sure you create a "classic" token. Fine-grained tokens are not supported.
