Github Server

1. Before you begin.

   1. Grant the Prisma Cloud user the necessary permissions for integrating Prisma Cloud with your GitHub Server VCS, as specified in User Permissions below.
   2. Add the Prisma Cloud IP addresses and hostname for Application Security to an allow list to enable access to the Prisma Cloud Console.
   3. Ensure that the provided hostname or IP address is resolvable on public DNS servers.
   4. Ensure the use of the default port 443 for the integration.
2. On the Prisma Cloud Application Security console.

   1. In Application Security, select Settings > Connect Provider > Code & Build Providers.

      
   2. Select GitHub Server (under Code Repositories) in the catalog that is displayed.

      

      The Configure Domain step of the integration wizard (wizard) is displayed.
   3. Paste the URL of your GitHub Server repository into the provided field > Register.

      The Base URL must include the "HTTPS://" prefix.

      The Register OAUTH app step of the wizard is displayed.

      
   4. Copy the values displayed in the Application Name, Homepage URL and Authorization Callback URL fields > Next.

      You are redirected to your GitHub Server.

      
3. On the Github Server console.

   1. Paste the Application Name, Homepage URL and Authorization Callback URL values copied in step 2 above into the provided fields > Register Application.

      The details of the new OAUTH Prisma Cloud Application Security application is displayed in a dialog.

      
   2. Copy the Client ID and Client Secret values > Authorize.
4. On Prisma Cloud.

   1. Paste the copied Client ID and Client Secret values generated above in the Set Client ID and Secret step of the wizard > Authorize.

      The Select Repositories step of the wizard is displayed.

      
   2. Select which repositories will be scanned.

      • Permit all existing repositories
      • Permit all existing and future repositories. This is the recommended option to ensure complete coverage and successful operation of all features.
      • Choose from repository list > Select repositories
   3. Select Next. The New account successfully configured message appears after you have successfully set up the configurations.
   4. Select Done in the Status step of the wizard to complete the integration.
5. Verify integration.

   1. In Application Security, select Home > Settings > Code & Build Providers.
   2. Confirm that the status of the integrated GitHub repositories displays Connected under Status.

      It may take up to 3 minutes for the integration status to be updated.
6. Next step: Monitor and manage scan results.

   • View your selected GitHub Server repositories on the Repositories page. The next GitHub Server scan will include these repositories
   • To view scan results and resolve issues, in Application Security select Home > Projects. See Monitor and Manage Code Build Issues for more information

User Permissions

• Organization owner permissions
• Administrator repository permissions: In order to scan pull requests (PRs), the user performing the integration must have administrative privileges for the repositories. This enables Prisma Cloud to set up subscription webhooks for the selected repositories
• repo: Grants full access to public and private repositories, including read and write access to code, commit statuses, repository invitations, collaborators, deployment statuses, and the capability to subscribe the repository to receive new webhook notifications or events

  In addition to repository-related resources, the repository scope also grants access to manage organization-owned resources, including projects, invitations, team memberships, and webhooks. This scope also grants the ability to manage projects owned by users
• read:user: Grants access to read a user’s profile data
• read:repo_hook: Grants read and ping access to hooks in public or private repositories
• read:org: Provides read-only access to organization membership, organization projects, and team membership
• read:public_key: Allows listing and viewing details for public keys
• workflow: Provides the ability to add and update GitHub Actions workflow files. Workflow files can be committed without this scope if the same file (with both the same path and contents) exists on another branch in the same repository. Workflow files can expose GITHUB_TOKEN, which may have a different set of scopes. For more information, see the GitHub Actions Automatic token authentication documentation.
• admin:org_hook: Grants read, write, ping, and delete access to organization hooks. Note: OAuth tokens will only be able to perform these actions on organization hooks created by the OAuth app. Personal access tokens will only be able to perform these actions on organization hooks created by a user

Subscribed Events

• Repository events: All events related to repositories
• Organization events: Includes ['organization', 'membership','team'] events