GitHub

Our GitHub integration collects metadata about your organizations activity across repositories, pull requests, and deployments. We never read, transmit, or store source code. Sensitive data, such as branch names and pull request titles, are always encrypted.

Permissions

We request only the necessary permissions to analyze Git metadata. Below is a description of the scopes requested when connecting to GitHub:

• Repository: Read access to actions, checks, code, commit statuses, deployments, issues, metadata, and pull requests
• Organization: Read access to members, organization administration, organization copilot seat management, and organization projects
• User: Read access to email addresses, public repositories, public organization information, and public user profile data

We require read access to metadata for commits, branches, and releases. Since GitHubs API does not offer more granular permissions for these specific endpoints, we must request read access to all repository contents. Please note that we never read, transmit, or store source code.

You can learn more about permissions for GitHub Apps in GitHubs documentation.

Requesting App Access

Creating an Antenna organization requires a GitHub organization. By default, OAuth app access restrictions are enabled for GitHub organizations:

When OAuth app access restrictions are enabled, organization members and outside collaborators cannot authorize OAuth app access to organization resources. Organization members can request owner approval for OAuth apps theyd like to use, and organization owners receive a notification of pending requests.

If you do not see your GitHub organization when trying to create an Antenna organization, you will need to request that an organization admin approves the Antenna application for use in your organization.

You can request access from your GitHub account, or follow GitHubs guide on how to request OAuth app access. An organization admin will then need to approve the request.

IP Allowlisting

If your organization restricts access by IP address, you must allow traffic from Antenna before connecting your Git provider. All of our API requests come from a fixed set of load balancer IP addresses, so an active allowlist that does not include them will block both sign-in and data imports.

Add all five addresses below. In tools that require CIDR notation, append /32 to each address (for example, 100.21.131.68/32).

GitHub Enterprise Cloud

Allow lists can be configured at both the organization and the enterprise level, and each one is enforced independently. If your enterprise owns the allow list, an organization owner cannot fix it on their own an enterprise owner must add the addresses too.

Every way of connecting GitHub needs our addresses allowed:

Troubleshooting

• Signing up or signing in with your GitHub account redirects you back to the login page: our request to GitHubs user API was blocked. Add the addresses manually, then try again.
• GitHub is connected but GitHub Copilot reports an invalid token: the personal access token is valid, but our requests are blocked. Confirm the addresses were added manually rather than only through the GitHub App.