GH-100: GitHub AdministrationDemo

The token identifier links an event to the credential, the requesting IP address identifies the request origin, and the associated user or actor identifies the account connected to the activity. GitHub audit-log events include token and user/actor fields, and source IP addresses can be displayed for eligible events.

GitHub-hosted runner minutes have per-minute rates that vary by operating system (and runner processing power). For example, Linux, Windows, and macOS runners have different rates, so the runner environment’s operating system affects pricing.

GitHub Enterprise supports compliance through configurable governance and security controls, including enterprise audit logs for monitored activity, SAML single sign-on for centralized authentication and access control, and enterprise rulesets that govern how users interact with repositories.

Team synchronization depends on deliberate mappings between identity-provider groups and GitHub teams so that membership and the resulting team access align with the organization’s intended roles. After a GitHub team is connected to an IdP group, membership changes are managed through the identity provider rather than manually in GitHub.

GitHub-hosted larger runners can be assigned static public IP address ranges that are unique to the runner pool. This provides an exclusive, predictable range for firewall allowlisting, unlike the broadly shared IP ranges published for standard GitHub-hosted runners.

Enterprise Managed Users are provisioned and managed through an identity provider such as Microsoft Entra ID (formerly Azure AD). They authenticate through that identity provider, are restricted to enterprise resources rather than external GitHub collaboration, and remain organization-managed accounts that cannot be completely removed from the enterprise by the user.

Exposed credentials must be revoked or rotated immediately so they can no longer be used by anyone who obtained them. Removing data from a repository or its history cannot guarantee that copied credentials are invalidated.

Personal Accounts are created and owned by individual users and may be used under one identity for personal, open-source, and professional projects. Enterprise Managed User accounts are instead provisioned and managed by an enterprise through its identity provider, with enterprise-controlled access and restrictions on activity outside the enterprise.

An outside collaborator is not a member of the organization and is granted access to one or more specific organization repositories, with the access level chosen for that collaborator. GitHub Docs: Adding outside collaborators to repositories in your organization

GitHub Advanced Security helps developers find and fix security issues in code, dependencies, and exposed secrets, improving the security and quality of the codebase.

Enterprise-wide SAML SSO centrally applies one SAML configuration and IdP across all organizations owned by the enterprise, enforcing a consistent authentication experience. Organization-level SAML SSO instead permits separate configurations for individual organizations, including different SAML authentication providers.

Branch protection rules and rulesets can restrict who may push to matching branches; for example, a ruleset that restricts updates permits pushes only for actors with bypass permission. Confirming the user’s repository permissions and the branch’s applicable rulesets identifies the specific access restriction before any corrective change is made.

GitHub Premium Support includes GitHub Enterprise Support benefits, which cover installing and using GitHub Enterprise Server. GitHub identifies writing scripts, hardware setup, and third-party integrations as requests that are generally outside its support scope.

GitHub API clients should operate within primary and secondary rate limits so requests are not throttled or rejected. Respecting rate limits and handling limit responses helps keep an integration available and avoids disruption.

A GitHub App authenticated with an installation access token on GitHub Enterprise Cloud has a higher API rate-limit ceiling—15,000 REST API requests per hour per installation—than the typical 5,000 requests per hour available to a personal access token used by a machine account. Installation limits are also independently budgeted per installation.

SCIM lets an identity provider manage the GitHub user-account lifecycle. It provisions accounts for assigned users, updates GitHub accounts when identity attributes change in the identity provider, and deprovisions or disables accounts when users are removed or deleted from the identity provider.

Dependabot security updates use the repository dependency graph and Dependabot alerts to identify vulnerable dependencies. When a patched version is available and the dependency can be updated safely, Dependabot opens a pull request to the minimum version containing the fix.

The Write repository role permits users to push to the repositories assigned to them. It does not grant permission to manage repository settings, configure branch protection rules, or delete a repository; protected branches also require elevated or explicit bypass permissions.

Enterprise owners can enforce GitHub Actions policies that control the options available to organizations in the enterprise. An enterprise-level policy can override an organization’s settings, making the enterprise configuration mandatory for the affected organizations.

When multiple GitHub rulesets target the same branch, their rules are aggregated and all applicable rules are enforced. If equivalent rules impose different requirements, GitHub applies the most restrictive requirement.

Fine-grained PATs can be configured to access only selected repositories and granted repository-specific permissions. This provides more targeted access control than the broad scopes used by classic PATs.

GitHub Apps can authenticate independently as an app and use fine-grained, installation-specific permissions limited to selected repositories and required actions. This avoids relying on a user identity and reduces the impact of leaked credentials compared with OAuth Apps, which act on behalf of an authorizing user.

The audit-log GraphQL API exposes permission changes, promotions of users to administrator status, and changes to a GitHub App’s permissions. Git clone and push events are Git events and must be retrieved through the REST audit-log API rather than GraphQL.

Organization runner groups support a repository-access policy that limits use of their self-hosted runners to a specified list of repositories. Configure that access policy in the runner group settings.