> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/code-repositories/add-github-server.md).
# Github Server
Integrate Prisma Cloud with your GitHub Server version control system (VCS) to gain visibility into, and monitor the systems, technologies, configurations, and pipelines that make up the GitHub Server platform.
This integration enables security scans to identify Infrastructure-as-Code (IaC) misconfigurations, Software Composition Analysis (SCA) vulnerabilities, exposed secrets, license mis-compliance and CI/CD pipeline risks in your GitHub Server environment, allowing you to understand and fix issues as soon as they are detected, resulting in an enhanced security posture for your organization.
The GitHub Server integration creates a webhook that triggers periodic scans of your code. These scans run on all pull requests (PRs), and their results are displayed in both the PR comments and reports.
Refer to [Subscribed Events](#subscribed-events) below for a list of events to which the integration is subscribed.
1. Before you begin.
1. Grant the Prisma Cloud user the necessary permissions for integrating Prisma Cloud with your GitHub Server VCS, as specified in [User Permissions](#user-permissions) below.
2. Add the Prisma Cloud IP addresses and hostname for Application Security to an [allow list](/content-collections/get-started/console-prerequisites.md) to enable access to the Prisma Cloud Console.
3. Ensure that the provided hostname or IP address is resolvable on public DNS servers.
4. Ensure the use of the default port 443 for the integration.
2. On the Prisma Cloud Application Security console.
1. In Application Security, select **Settings** > **Connect Provider** > **Code & Build Providers**.
2. Select **GitHub Server** (under Code Repositories) in the catalog that is displayed.
The **Configure Domain** step of the integration wizard (wizard) is displayed.
3. Paste the URL of your GitHub Server repository into the provided field > **Register**.
The **Base URL** must include the **"HTTPS://"** prefix.
The **Register OAUTH app** step of the wizard is displayed.
4. Copy the values displayed in the **Application Name**, **Homepage URL** and **Authorization Callback URL** fields > **Next**.
You are redirected to your GitHub Server.
3. On the Github Server console.
1. Paste the Application Name, Homepage URL and Authorization Callback URL values copied in step 2 above into the provided fields > **Register Application**.
The details of the new OAUTH Prisma Cloud Application Security application is displayed in a dialog.
2. Copy the **Client ID** and **Client Secret** values > **Authorize**.
4. On Prisma Cloud.
1. Paste the copied Client ID and Client Secret values generated above in the **Set Client ID and Secret** step of the wizard > **Authorize**.
The **Select Repositories** step of the wizard is displayed.
2. Select which repositories will be scanned.
* **Permit all existing repositories**
* **Permit all existing and future repositories**. This is the recommended option to ensure complete coverage and successful operation of all features.
* **Choose from repository list** > Select repositories
3. Select **Next**. The **New account successfully configured** message appears after you have successfully set up the configurations.
4. Select **Done** in the **Status** step of the wizard to complete the integration.
5. Verify integration.
1. In **Application Security**, select **Home** > **Settings** > **Code & Build Providers**.
2. Confirm that the status of the integrated **GitHub** repositories displays **Connected** under **Status**.
It may take up to 3 minutes for the integration status to be updated.
6. Next step: Monitor and manage scan results.
* View your selected GitHub Server repositories on the **Repositories** page. The next GitHub Server scan will include these repositories
* To view scan results and resolve issues, in **Application Security** select **Home** > **Projects**. See [Monitor and Manage Code Build Issues](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/application-security/risk-management/monitor-and-manage-code-build/monitor-and-manage-code-build.md) for more information
## User Permissions
Authorize the user integrating Prisma Cloud with your GitHub Server instance with the following permissions.
* **Organization owner** permissions
* **Administrator repository permissions**: In order to scan pull requests (PRs), the user performing the integration must have administrative privileges for the repositories. This enables Prisma Cloud to set up subscription webhooks for the selected repositories
* **repo**: Grants full access to public and private repositories, including read and write access to code, commit statuses, repository invitations, collaborators, deployment statuses, and the capability to subscribe the repository to receive new webhook notifications or events
In addition to repository-related resources, the repository scope also grants access to manage organization-owned resources, including projects, invitations, team memberships, and webhooks. This scope also grants the ability to manage projects owned by users
* **read:user**: Grants access to read a user’s profile data
* **read:repo\_hook**: Grants read and ping access to hooks in public or private repositories
* **read:org**: Provides read-only access to organization membership, organization projects, and team membership
* **read:public\_key**: Allows listing and viewing details for public keys
* **workflow**: Provides the ability to add and update GitHub Actions workflow files. Workflow files can be committed without this scope if the same file (with both the same path and contents) exists on another branch in the same repository. Workflow files can expose GITHUB\_TOKEN, which may have a different set of scopes. For more information, see the GitHub Actions [Automatic token authentication](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) documentation.
* **admin:org\_hook**: Grants read, write, ping, and delete access to organization hooks. Note: OAuth tokens will only be able to perform these actions on organization hooks created by the OAuth app. Personal access tokens will only be able to perform these actions on organization hooks created by a user
## Subscribed Events
Below is a comprehensive list of events to which Prisma Cloud is subscribed. These events encompass various actions and changes occurring within your GitHub Server environment that trigger notifications and integrations with Prisma Cloud.
* **Repository** events: All events related to repositories
* **Organization** events: Includes `['organization', 'membership','team']` events
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/code-repositories/add-github-server.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.