GitHub
Collect repository and organization evidence through a dedicated GitHub App with read-only permissions.
Create the app
Create an organization-owned GitHub App and install it on every repository in the audit scope. Grant these read permissions:
| Scope | Permissions |
|---|---|
| Organization | Members; Administration |
| Repository | Metadata; Administration; Contents; Pull requests; Checks; Commit statuses; Dependabot alerts; Code scanning alerts; Secret scanning alerts |
Generate a private key for the app. Retain the app ID, organization name and PEM key. Enter the installation ID if required to select the intended installation.
Define production scope
In Sparta's GitHub connection, set the production topic, explicit production repository list or both. Check that the app installation includes those repositories.
Configure login-to-email mappings when identities differ across systems. Identify service accounts explicitly so they are not mistaken for people.
Collect and review
Run the connection check and evidence collection. Review branch protection, access, scanning and sampled pull-request evidence on the relevant controls.
The pull-request sample defaults to 25. A sample does not cover every change. Incomplete API pages and inaccessible scanning endpoints require review; they are not evidence of an empty or passing result.