GitHub

​

Prerequisites

• A GitHub account with admin access to your organisation
• Access to your ewake dashboard

​

Choose a connection method

​

Configuration

• GitHub App (recommended)
• Personal access token

The App method has two parts: OAuth authorization (user-level) and GitHub App installation (organisation-level). Both are required.

​

Part 1, OAuth Authorization

1

Click Authorize with GitHub

In your ewake dashboard → Integrations → GitHub → click Authorize with GitHub.

2

Review and authorize

Review the permissions on GitHub’s authorization page → click Authorize.You’ll be redirected back to the ewake dashboard.

​

Part 2, GitHub App Installation

OAuth alone doesn’t grant access to organisation repositories. The GitHub App installation is a separate step.

1

Click Install ewake GitHub App

In the ewake dashboard, click Install ewake GitHub App.

2

Select your organisation

Choose the organisation where ewake should be installed.

3

Choose repository access

Select repositories

Recommended. Grant access only to repos relevant to your production environment. More control, smaller footprint.

All repositories

Simpler to set up. ewake only reads repos relevant to an active investigation.

If using Select repositories, use this as a guide:

Include	Exclude
Service code	Repos containing secrets or credentials
Deployment configs (Helm, k8s manifests)	Customer data or PII repositories
Infrastructure as code (Terraform, Pulumi)	Audit or compliance-only repos
CI/CD pipeline definitions	Archived or unused repos

4

Install

Click Install. You’ll be redirected back to ewake.

GitHub is connected. Ewake can now access your repositories and deployment history.

Ewake only requires read access to GitHub. It never writes to repositories, opens pull requests, pushes code, or modifies any data in your organisation.

Use this when the App install cannot complete — most often because your organisation restricts third-party GitHub Apps, or because you run ewake in your own AWS account and the OAuth flow is not available.A fine-grained token is preferred: its permissions are genuinely read-only and scoped to the repositories you pick. A classic token works too, but its repo scope is all-or-nothing.

1

Create a fine-grained token

Go to GitHub → Settings → Developer settings → Personal access tokens → Fine-grained tokens → Generate new token.Set Resource owner to your organisation, not your personal account. This is the single most common mistake — a token owned by your user can authenticate but sees none of the organisation’s repositories.

2

Choose repository access

Select Only select repositories and pick the ones ewake should see, or All repositories for the whole organisation.

Include	Exclude
Service code	Repos containing secrets or credentials
Deployment configs (Helm, k8s manifests)	Customer data or PII repositories
Infrastructure as code (Terraform, Pulumi)	Audit or compliance-only repos
CI/CD pipeline definitions	Archived or unused repos

3

Set the permissions

All Read-only. Nothing here grants write access.Repository permissions

Permission	What it enables
Metadata	Listing repositories, branches, contributors (mandatory)
Contents	Source code, commits, diffs, file trees, releases
Pull requests	Correlating PRs with deployments and incidents
Issues	Issue timelines referenced during an investigation
Actions	Workflow runs, jobs and job logs for CI failures
Deployments	Deployment events and their statuses

Organisation permissions

Permission	What it enables
Members	Resolving the organisation and its repository list

Prefer a classic token? Select repo and read:org. repo is broader than ewake needs — it is the narrowest classic scope that covers private repository contents.

4

Approve the token if your organisation requires it

Some organisations require an owner to approve fine-grained tokens before they work. Check Organisation settings → Personal access tokens → Pending requests.Until it is approved the token authenticates but returns no repositories.

5

Connect it in ewake

In your ewake dashboard → Integrations → GitHub → choose the token option, then paste the token and your organisation name exactly as it appears in GitHub URLs.

Ewake validates the token before saving it. It must be able to read your user, resolve the organisation, and read the contents of at least one repository.

​

If the connection is rejected

Ewake names the check that failed rather than saving a token that cannot work:

Message	Cause
Cannot read user	The token is expired, revoked, or mistyped
Cannot see an organisation called ”…”	Wrong organisation name, or the token is not authorised for it
Cannot read repository contents	Resource owner is your personal account, no repositories were selected, or the token is awaiting organisation approval

The last one is the usual culprit. A token that authenticates but sees no repositories would connect green and then return nothing on every investigation, so ewake refuses it up front.

Fine-grained tokens have a maximum lifetime and expire. When one does, integrations stop returning data — reissue the token and paste the new one in the same place.

​

Can’t see your org repositories?