Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: GitHub Org Audit Tool

github.com

Post reply on HN
Print view View original

1–10 of 24 posts

Re: Show HN: GitHub Org Audit Tool

#3

Post by megamorf »

Unfortunately, it leaves a lot to be desired. I've actually had to do a fair bit of GH access reporting myself recently and I can recommend the GraphQL API as it allows you to properly list direct and indirect permissions on repositories (org + team + direct collaborator) that are alot harder to do with the REST API due to its inconsistent permissions model.

Re: Show HN: GitHub Org Audit Tool

#5

Post by coenhyde »

candiddevmike wrote: post #2

Why audit when you can declare all of this in Terraform? https://registry.terraform.io/providers/integrations/github/...

As much a fan of Terraform I am. If you didn't started defining your repos in Terraform from day 0, importing hundreds of repos, members, permission sets would be quite a lot more work than running this audit tool.

Re: Show HN: GitHub Org Audit Tool

#6

Post by gtirloni »

candiddevmike wrote: post #2

Why audit when you can declare all of this in Terraform? https://registry.terraform.io/providers/integrations/github/...

Terraform doesn't know what it doesn't know. It only cares about stuff you defined in code and ignores all the rest. You can't use it for auditing purposes, except in its narrow scope.

Re: Show HN: GitHub Org Audit Tool

#8

Post by andrewstuart2 »

coenhyde wrote: post #5
candiddevmike wrote: post #2

Why audit when you can declare all of this in Terraform? https://registry.terraform.io/providers/integrations/github/...

As much a fan of Terraform I am. If you didn't started defining your repos in Terraform from day 0, importing hundreds of repos, members, permission sets would be quite a lot more work than running this audit tool.

And quite frankly, terraform is great at first, and maybe for smaller projects, but for larger cases it becomes unmaintainable and unrefactorable pretty quickly.

Re: Show HN: GitHub Org Audit Tool

#9

Post by nathanwallace »

atonse wrote: post #4

How about using steampipe for this?

Thanks atonse for the shout out!

Steampipe [1] is an open source CLI to query your cloud resources (e.g. GitHub, AWS, Splunk, etc) with SQL. The GitHub plugin has 44 tables to query [2].

The "GitHub Sherlock" mod includes 34 automated controls for organization, repo and issue best practices. The "GitHub Compliance" mod has 35 automated controls for supply chain security. Mods are written in HCL + SQL. [3]

1 - https://steampipe.io 2 - https://hub.steampipe.io/plugins/turbot/github 3 - https://hub.steampipe.io/mods?q=github

Re: Show HN: GitHub Org Audit Tool

#10

Post by benfrancom »

megamorf wrote: post #3

Unfortunately, it leaves a lot to be desired. I've actually had to do a fair bit of GH access reporting myself recently and I can recommend the GraphQL API as it allows you to properly list direct and indirect permissions on repositories (org + team + direct collaborator) that are alot harder to do with the REST API due to its inconsistent permissions model.

Nice, do you have anything you can share?
Post reply on HN