GitHub
Integrate Prisma Cloud with your GitHub version control system (VCS) to gain visibility into, and monitor the systems, technologies, configurations, and pipelines that make up the GitHub platform.
This integration enables security scans to identify Infrastructure-as-Code (IaC) misconfigurations, Software Composition Analysis (SCA) vulnerabilities, exposed secrets, license mis-compliance and CI/CD pipeline risks in your GitHub environment, allowing you to understand and fix issues as soon as they are detected, resulting in an enhanced security posture for your organization.
The GitHub integration creates a webhook that triggers periodic scans of your code. These scans run on all pull requests (PRs), and their results are displayed in both the PR comments and reports.
Refer to Subscribed Events below for a list of subscribed events for which the integration is subscribed to.
Before you begin.
Grant the Prisma Cloud user the necessary permissions for integrating Prisma Cloud with your GitHub VCS, as specified in User Permissions below.
Add the Prisma Cloud IP addresses and hostname for Application Security to an allow list to enable access to the Prisma Cloud Console.
On the Prisma Cloud Application Security console.
In Application Security, select Home > Settings > Connect Provider > Code & Build Providers.
Select GitHub (under Code Repositories) in the catalog that is displayed.
Select Authorize in the Configure Account step of the integration wizard that is displayed.
You are redirected to GitHub to authorize Prisma Cloud access.
Authorize Prisma Cloud on GitHub.
Select Authorize to authenticate your account through your SSO provider > complete the required process.
Select Authorize Prisma Cloud DevOps.
Select the organization on which Prisma Cloud will be installed.
Select the repositories to be authorized.
All repositories applies to all current and future repositories owned by the resource owner
This is the recommended option to ensure complete coverage and successful operation of all features.
Only select repositories > Select repositories allows you to authorize selected repositories from the menu
Review the permissions granted when authorizing Prisma Cloud on GitHub.
Select Install & Authorize.
You are redirected to the Select Repositories step of the GitHub installation wizard on the Prisma Cloud console.
Refer to the GitHub Documentation for more on authorizing and installing GitHub Apps.
On the Prisma Cloud console.
Select an option to determine which repositories will be scanned.
Permit all existing repositories
Permit all existing and future repositories
This is the recommended option to ensure complete coverage and successful operation of all features.
Choose from repository list > select repositories
Select Next > Done in the Status step of the wizard to complete the integration.
Verify integration.
In Application Security, select Home > Settings > Code & Build Providers tab.
Confirm that the status of the integrated GitHub repositories displays Connected under Status.
It may take up to 3 minutes for the integration status to be updated.
Next step: Monitor and manage scan results.
View your selected GitHub repositories on the Repositories page. The next GitHub scan will include these repositories
To view scan results and resolve issues, in Application Security select Home > Projects. See Monitor and Manage Code Build Issues for more information
User Permissions
Authorize the user integrating Prisma Cloud with your GitHub instance with the following permissions.
Read access to Dependabot alerts, actions, actions variables, administration, deployments, discussions, metadata, packages, repository hooks, secret scanning alerts, secrets, and security events
Read and write access to checks, code, commit statuses, issues, and pull requests
In contrast to GitLab, GitLab Enterprise, and Azure, there is no individual record of each token used for authentication on the integrations page. This might give the impression to users that they are overriding the integration. However, Prisma Cloud retains previous tokens and utilize them to perform necessary actions. If a user removes the integration, all associated tokens will be removed along with it.
Subscribed Events
Below is a comprehensive list of events to which Prisma Cloud is subscribed. These events encompass various actions and changes occurring within your GitHub environment that trigger notifications and integrations with Prisma Cloud:
Create: Indicates the creation of a branch or tag
Commit comment: Refers to comments made on a commit or a 'diff' comment, which compares changes within a commit
Issues: Includes a wide range of actions such as opening, editing, deleting, transferring, pinning, unpinning, closing, reopening, assigning, unassigning, labeling, unlabeling, milestone management (milestoned, demilestoned), and locking or unlocking an issue
Public: Denotes changes made to a repository from private to public
Pull request: Represents actions related to pull requests, including assignment, enabling or disabling auto merge, closing, conversion to draft, demilestoning, dequeuing, editing, enqueuing, labeling, locking, milestone assignment, opening, readiness for review, reopening, removal of review requests, request for review, synchronization, unassignment, unlabeling, and unlocking
Pull request review comment: Indicates the creation, editing, or deletion of a comment on a pull request’s diff
Push: Refers to a Git push operation performed on a repository
Repository: Includes actions such as creation, deletion, archiving, unarchiving, publicizing, privatizing, editing, renaming, or transferring of a repository
Last updated
Was this helpful?