fix(github): provider always scans user instead of organization when using provider UID (#8587)

api/CHANGELOG.md

@@ -9,6 +9,9 @@ All notable changes to the **Prowler API** are documented in this file.
 - Integration with Amazon Security Hub, enabling sending findings to Security Hub [(#8365)](https://github.com/prowler-cloud/prowler/pull/8365)
 - Generate ASFF output for AWS providers with SecurityHub integration enabled [(#8569)](https://github.com/prowler-cloud/prowler/pull/8569)
 
+### Fixed
+- GitHub provider always scans user instead of organization when using provider UID [(#8587)](https://github.com/prowler-cloud/prowler/pull/8587)
+
 ## [1.11.0] (Prowler 5.10.0)
 
 ### Added

api/src/backend/api/tests/test_utils.py

@@ -199,6 +199,10 @@ class TestGetProwlerProviderKwargs:
                 Provider.ProviderChoices.M365.value,
                 {},
             ),
+            (
+                Provider.ProviderChoices.GITHUB.value,
+                {"organizations": ["provider_uid"]},
+            ),
         ],
     )
     def test_get_prowler_provider_kwargs(self, provider_type, expected_extra_kwargs):

api/src/backend/api/utils.py

@@ -120,6 +120,12 @@ def get_prowler_provider_kwargs(
         }
     elif provider.provider == Provider.ProviderChoices.KUBERNETES.value:
         prowler_provider_kwargs = {**prowler_provider_kwargs, "context": provider.uid}
+    elif provider.provider == Provider.ProviderChoices.GITHUB.value:
+        if provider.uid:
+            prowler_provider_kwargs = {
+                **prowler_provider_kwargs,
+                "organizations": [provider.uid],
+            }
 
     if mutelist_processor:
         mutelist_content = mutelist_processor.configuration.get("Mutelist", {})

docs/tutorials/github/getting-started-github.md

@@ -44,13 +44,13 @@ Personal Access Tokens provide the simplest GitHub authentication method, but it
     To enable Prowler functionality, configure the following permissions:
 
     - **Repository permissions:**
+        - **Administration**: Read-only access
         - **Contents**: Read-only access
         - **Metadata**: Read-only access
         - **Pull requests**: Read-only access
-        - **Security advisories**: Read-only access
-        - **Statuses**: Read-only access
 
     - **Organization permissions:**
+        - **Administration**: Read-only access
         - **Members**: Read-only access
 
     - **Account permissions:**

prowler/CHANGELOG.md

@@ -23,6 +23,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 ### Fixed
 - Resource metadata error in `s3_bucket_shadow_resource_vulnerability` check [(#8572)](https://github.com/prowler-cloud/prowler/pull/8572)
+- GitHub App authentication through API fails with auth_method validation error [(#8587)](https://github.com/prowler-cloud/prowler/pull/8587)
 
 ---
 

prowler/providers/github/github_provider.py

@@ -156,7 +156,7 @@ class GithubProvider(Provider):
             self._auth_method = "Personal Access Token"
         elif oauth_app_token:
             self._auth_method = "OAuth App Token"
-        elif github_app_id and github_app_key:
+        elif github_app_id and (github_app_key or github_app_key_content):
             self._auth_method = "GitHub App Token"
         elif environ.get("GITHUB_PERSONAL_ACCESS_TOKEN", ""):
             self._auth_method = "Environment Variable for Personal Access Token"

prowler/providers/github/services/repository/repository_service.py

@@ -153,9 +153,10 @@ class Repository(GithubService):
                                 self._handle_github_api_error(
                                     error, "processing organization", org_name
                                 )
-                    if (
+                    elif (
                         isinstance(self.provider.identity, GithubAppIdentityInfo)
                         and self.provider.identity.installations
+                        and not self.provider.repositories
                     ):
                         logger.info(
                             f"Filtering for repositories in the organizations or accounts that the GitHub App is installed in: {', '.join(self.provider.identity.installations)}"