Skip to content

baton-github-enterprise: import the latest baton-github #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Bencheng21 merged 1 commit into from
Jun 2, 2026
Merged

baton-github-enterprise: import the latest baton-github #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,9 @@ in order to sync secrets, you must use a token created using a github app instal
- [docs](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-user-access-token-for-a-github-app)
- [rest api](https://docs.github.com/rest/orgs/personal-access-tokens#list-fine-grained-personal-access-tokens-with-access-to-organization-resources)

# License Resource Type
The `license` resource type only works with a personal access token (PAT). GitHub App installation tokens are not supported for syncing licenses.

# Contributing, Support and Issues

We started Baton because we were tired of taking screenshots and manually building spreadsheets. We welcome contributions, and ideas, no matter how small -- our goal is to make identity and permissions sprawl less painful for everyone. If you have questions, problems, or ideas: Please open a GitHub Issue!
Expand Down
66 changes: 66 additions & 0 deletions baton_capabilities.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,46 @@
{

@github-actions github-actions Bot May 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Suggestion: DefaultCapabilitiesBuilder now includes OrgBuilder (added in this commit), but baton_capabilities.json doesn't have an org resource type entry. The JSON should be regenerated so the checked-in capabilities match the builder.

"@type": "type.googleapis.com/c1.connector.v2.ConnectorCapabilities",
"resourceTypeCapabilities": [
{
"resourceType": {
"id": "api-key",
"displayName": "API Key",
"traits": [
"TRAIT_SECRET"
],
"annotations": [
{
"@type": "type.googleapis.com/c1.connector.v2.SkipEntitlementsAndGrants"
}
]
},
"capabilities": [
"CAPABILITY_SYNC"
],
"permissions": {}
},
{
"resourceType": {
"id": "enterprise_role",
"displayName": "Enterprise Role",
"traits": [
"TRAIT_ROLE"
],
"annotations": [
{
"@type": "type.googleapis.com/c1.connector.v2.V1Identifier",
"id": "enterprise_role"
},
{
"@type": "type.googleapis.com/c1.connector.v2.SkipEntitlements"
}
]
},
"capabilities": [
"CAPABILITY_SYNC"
],
"permissions": {}
},
{
"resourceType": {
"id": "invitation",
Expand All @@ -22,6 +62,32 @@
],
"permissions": {}
},
{
"resourceType": {
"id": "license",
"displayName": "License",
"traits": [
"TRAIT_LICENSE_PROFILE"
],
"annotations": [
{
"@type": "type.googleapis.com/c1.connector.v2.V1Identifier",
"id": "license"
},
{
"@type": "type.googleapis.com/c1.connector.v2.SkipEntitlements"
},
{
"@type": "type.googleapis.com/c1.connector.v2.OptInRequired"
}
]
},
"capabilities": [
"CAPABILITY_SYNC"
],
"permissions": {},
"optInRequired": true
},
{
"resourceType": {
"id": "org",
Expand Down
3 changes: 1 addition & 2 deletions cmd/baton-github-enterprise/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@ import (
"context"

cfg "github.com/conductorone/baton-github-enterprise/pkg/config"
githubConnector "github.com/conductorone/baton-github/pkg/connector"
"github.com/conductorone/baton-sdk/pkg/config"
"github.com/conductorone/baton-sdk/pkg/connectorrunner"

Expand All @@ -21,6 +20,6 @@ func main() {
cfg.Config,
connector.NewLambdaConnector,
connectorrunner.WithSessionStoreEnabled(),
connectorrunner.WithDefaultCapabilitiesConnectorBuilderV2(&githubConnector.GitHub{}),
connectorrunner.WithDefaultCapabilitiesConnectorBuilderV2(connector.DefaultCapabilitiesBuilder()),
)
}
12 changes: 9 additions & 3 deletions docs/connector.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,18 +19,24 @@ If you access GitHub at `github.com`, go to the [GitHub](/baton/github) integrat
| Accounts | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | <Icon icon="square-check" iconType="solid" color="#c937ae"/> |
| Repositories | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | <Icon icon="square-check" iconType="solid" color="#c937ae"/> |
| Teams | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | <Icon icon="square-check" iconType="solid" color="#c937ae"/> |
| Orgs* | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | <Icon icon="square-check" iconType="solid" color="#c937ae"/> |
| Org roles/Enterprise licenses** | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | <Icon icon="square-check" iconType="solid" color="#c937ae"/> |
| Orgs\* | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | <Icon icon="square-check" iconType="solid" color="#c937ae"/> |
| Org roles\*\* | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | <Icon icon="square-check" iconType="solid" color="#c937ae"/> |
| Enterprise roles | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | |
| Licenses | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | |
| Secrets - API keys | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | |

The GitHub Enterprise connector supports [automatic account provisioning and deprovisioning](/product/admin/account-provisioning). New accounts will send an invitation to the account owner; if an invitation is pending, the account status will be shown as **Unspecified**.

* Due to limitations on the GitHub API, syncing multiple orgs requires a personal access token (PAT). A separate connector and GitHub app is required when using the GitHub App integration.
\* Due to limitations on the GitHub API, syncing multiple orgs requires a personal access token (PAT). A separate connector and GitHub app is required when using the GitHub App integration.

\*\* Organization roles are also referred to as "enterprise licenses" in GitHub's documentation.

[This connector can sync secrets](/product/admin/inventory) and display them on the **Inventory** page.

<Warning>
Syncing the **Licenses** resource type only works with a personal access token (classic). GitHub App installation tokens are not supported for license sync.
</Warning>

## Gather GitHub Enterprise credentials

Configuring the connector requires you to pass in credentials generated in GitHub Enterprise. Gather these credentials before you move on. To set up the GitHub Enterprise connector, you can choose to create either a personal access token (classic) or a fine-grained access token.
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ module github.com/conductorone/baton-github-enterprise
go 1.25.2

require (
github.com/conductorone/baton-github v0.3.4
github.com/conductorone/baton-github v0.3.7
github.com/conductorone/baton-sdk v0.12.0
github.com/ennyjfrick/ruleguard-logfatal v0.0.2
github.com/quasilyte/go-ruleguard/dsl v0.3.23
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,8 +76,8 @@ github.com/cockroachdb/swiss v0.0.0-20251224182025-b0f6560f979b h1:VXvSNzmr8hMj8
github.com/cockroachdb/swiss v0.0.0-20251224182025-b0f6560f979b/go.mod h1:yBRu/cnL4ks9bgy4vAASdjIW+/xMlFwuHKqtmh3GZQg=
github.com/cockroachdb/tokenbucket v0.0.0-20230807174530-cc333fc44b06 h1:zuQyyAKVxetITBuuhv3BI9cMrmStnpT18zmgmTxunpo=
github.com/cockroachdb/tokenbucket v0.0.0-20230807174530-cc333fc44b06/go.mod h1:7nc4anLGjupUW/PeY5qiNYsdNXj7zopG+eqsS7To5IQ=
github.com/conductorone/baton-github v0.3.4 h1:XwN2IjsO0Np8W27/haEwLE6bzv3z4DOuDchap7OXNMA=
github.com/conductorone/baton-github v0.3.4/go.mod h1:FNqeFdfuFiweOvw3xaz0wiZzb7FtqaaHAZQu4BXohhs=
github.com/conductorone/baton-github v0.3.7 h1:wK65opd70uLjaSeuUfl5ZkK4h5nB4kZUQBWBK2fER7E=
github.com/conductorone/baton-github v0.3.7/go.mod h1:nnCvY6EzW768V5qbO95yEuLlMa97J2aWZ5qyirwYW/A=
github.com/conductorone/baton-sdk v0.12.0 h1:KD/7RfSo3CDRvdAJdtX87duaHBumgDQE1ro9K46QmcA=
github.com/conductorone/baton-sdk v0.12.0/go.mod h1:hNdQlCu0prYFQj8ysF/J+0zjUxdqjPPVBlZJVwMIb6o=
github.com/conductorone/dpop v0.2.6 h1:fakwai/Xm2b/fcDUwJN41WtcSI/2UhQOyRIVvnnrrNA=
Expand Down
30 changes: 30 additions & 0 deletions pkg/connector/connector.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@ import (
cfg "github.com/conductorone/baton-github-enterprise/pkg/config"
githubCfg "github.com/conductorone/baton-github/pkg/config"
"github.com/conductorone/baton-github/pkg/connector"
v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
"github.com/conductorone/baton-sdk/pkg/annotations"
"github.com/conductorone/baton-sdk/pkg/cli"
"github.com/conductorone/baton-sdk/pkg/connectorbuilder"
)
Expand All @@ -24,3 +26,31 @@ func NewLambdaConnector(ctx context.Context, ghc *cfg.Githubenterprise, cliOpts
DirectCollaboratorsOnly: ghc.DirectCollaboratorsOnly,
}, cliOpts)
}

func DefaultCapabilitiesBuilder() connectorbuilder.ConnectorBuilderV2 {
return &defaultCapabilitiesBuilder{}
}

type defaultCapabilitiesBuilder struct{}

func (d *defaultCapabilitiesBuilder) Metadata(_ context.Context) (*v2.ConnectorMetadata, error) {
return &v2.ConnectorMetadata{DisplayName: "GitHub Enterprise"}, nil
}

func (d *defaultCapabilitiesBuilder) Validate(_ context.Context) (annotations.Annotations, error) {
return nil, nil
}

func (d *defaultCapabilitiesBuilder) ResourceSyncers(_ context.Context) []connectorbuilder.ResourceSyncerV2 {
return []connectorbuilder.ResourceSyncerV2{
connector.OrgBuilder(nil, nil, nil, nil, false),
connector.TeamBuilder(nil, nil, false),
connector.UserBuilder(nil, nil, nil, nil, nil, nil),
connector.RepositoryBuilder(nil, nil, false, false),
connector.OrgRoleBuilder(nil, nil),
connector.InvitationBuilder(connector.InvitationBuilderParams{}),
connector.APITokenBuilder(nil, nil),
connector.EnterpriseRoleBuilder(nil, nil, nil, nil),
connector.LicenseBuilder(nil, nil),
}
Comment on lines +44 to +55

@github-actions github-actions Bot May 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Suggestion: DefaultCapabilitiesBuilder omits OrgBuilder, which removes the org resource type (previously with CAPABILITY_PROVISION) from the advertised capabilities. The runtime GitHub.ResourceSyncers still includes OrgBuilder, so orgs are synced but no longer declared in baton_capabilities.json. Confirm this mismatch is intentional — if downstream systems use capabilities to determine expected resource types or provisioning support, removing org could be a breaking change (B5).

}
4 changes: 3 additions & 1 deletion vendor/github.com/conductorone/baton-github/pkg/connector/api_token.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

31 changes: 23 additions & 8 deletions vendor/github.com/conductorone/baton-github/pkg/connector/connector.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion vendor/github.com/conductorone/baton-github/pkg/connector/enterprise_role.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions vendor/github.com/conductorone/baton-github/pkg/connector/invitation.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading