diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md index adc80ed8cf..a68d0f39ba 100644 --- a/api/CHANGELOG.md +++ b/api/CHANGELOG.md @@ -9,6 +9,9 @@ All notable changes to the **Prowler API** are documented in this file. - Integration with Amazon Security Hub, enabling sending findings to Security Hub [(#8365)](https://github.com/prowler-cloud/prowler/pull/8365) - Generate ASFF output for AWS providers with SecurityHub integration enabled [(#8569)](https://github.com/prowler-cloud/prowler/pull/8569) +### Fixed +- GitHub provider always scans user instead of organization when using provider UID [(#8587)](https://github.com/prowler-cloud/prowler/pull/8587) + ## [1.11.0] (Prowler 5.10.0) ### Added diff --git a/api/src/backend/api/tests/test_utils.py b/api/src/backend/api/tests/test_utils.py index e94504e902..cf58e41c0c 100644 --- a/api/src/backend/api/tests/test_utils.py +++ b/api/src/backend/api/tests/test_utils.py @@ -199,6 +199,10 @@ class TestGetProwlerProviderKwargs: Provider.ProviderChoices.M365.value, {}, ), + ( + Provider.ProviderChoices.GITHUB.value, + {"organizations": ["provider_uid"]}, + ), ], ) def test_get_prowler_provider_kwargs(self, provider_type, expected_extra_kwargs): diff --git a/api/src/backend/api/utils.py b/api/src/backend/api/utils.py index 1cc10674d7..b7c2f73ca3 100644 --- a/api/src/backend/api/utils.py +++ b/api/src/backend/api/utils.py @@ -120,6 +120,12 @@ def get_prowler_provider_kwargs( } elif provider.provider == Provider.ProviderChoices.KUBERNETES.value: prowler_provider_kwargs = {**prowler_provider_kwargs, "context": provider.uid} + elif provider.provider == Provider.ProviderChoices.GITHUB.value: + if provider.uid: + prowler_provider_kwargs = { + **prowler_provider_kwargs, + "organizations": [provider.uid], + } if mutelist_processor: mutelist_content = mutelist_processor.configuration.get("Mutelist", {}) diff --git a/docs/tutorials/github/getting-started-github.md b/docs/tutorials/github/getting-started-github.md index 48be3859bc..dca5ef584e 100644 --- a/docs/tutorials/github/getting-started-github.md +++ b/docs/tutorials/github/getting-started-github.md @@ -44,13 +44,13 @@ Personal Access Tokens provide the simplest GitHub authentication method, but it To enable Prowler functionality, configure the following permissions: - **Repository permissions:** + - **Administration**: Read-only access - **Contents**: Read-only access - **Metadata**: Read-only access - **Pull requests**: Read-only access - - **Security advisories**: Read-only access - - **Statuses**: Read-only access - **Organization permissions:** + - **Administration**: Read-only access - **Members**: Read-only access - **Account permissions:** diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 7323a56ad2..400bf81639 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -23,6 +23,7 @@ All notable changes to the **Prowler SDK** are documented in this file. ### Fixed - Resource metadata error in `s3_bucket_shadow_resource_vulnerability` check [(#8572)](https://github.com/prowler-cloud/prowler/pull/8572) +- GitHub App authentication through API fails with auth_method validation error [(#8587)](https://github.com/prowler-cloud/prowler/pull/8587) --- diff --git a/prowler/providers/github/github_provider.py b/prowler/providers/github/github_provider.py index 46dff4ab09..384c0b9de0 100644 --- a/prowler/providers/github/github_provider.py +++ b/prowler/providers/github/github_provider.py @@ -156,7 +156,7 @@ class GithubProvider(Provider): self._auth_method = "Personal Access Token" elif oauth_app_token: self._auth_method = "OAuth App Token" - elif github_app_id and github_app_key: + elif github_app_id and (github_app_key or github_app_key_content): self._auth_method = "GitHub App Token" elif environ.get("GITHUB_PERSONAL_ACCESS_TOKEN", ""): self._auth_method = "Environment Variable for Personal Access Token" diff --git a/prowler/providers/github/services/repository/repository_service.py b/prowler/providers/github/services/repository/repository_service.py index 501bd72601..4ca18813c5 100644 --- a/prowler/providers/github/services/repository/repository_service.py +++ b/prowler/providers/github/services/repository/repository_service.py @@ -153,9 +153,10 @@ class Repository(GithubService): self._handle_github_api_error( error, "processing organization", org_name ) - if ( + elif ( isinstance(self.provider.identity, GithubAppIdentityInfo) and self.provider.identity.installations + and not self.provider.repositories ): logger.info( f"Filtering for repositories in the organizations or accounts that the GitHub App is installed in: {', '.join(self.provider.identity.installations)}"