diff --git a/docs/tutorials/github/getting-started-github.md b/docs/tutorials/github/getting-started-github.md index b4f22d0366..48be3859bc 100644 --- a/docs/tutorials/github/getting-started-github.md +++ b/docs/tutorials/github/getting-started-github.md @@ -11,7 +11,7 @@ This guide explains how to set up authentication with GitHub for Prowler. The do ### 1. Personal Access Token (PAT) -Personal Access Tokens provide the simplest GitHub authentication method and support individual user authentication or testing scenarios. +Personal Access Tokens provide the simplest GitHub authentication method, but it can only access resources owned by a single user or organization. ???+ warning "Classic Tokens Deprecated" GitHub has deprecated Personal Access Tokens (classic) in favor of fine-grained Personal Access Tokens. We recommend using fine-grained tokens as they provide better security through more granular permissions and resource-specific access control. @@ -186,7 +186,10 @@ GitHub Apps provide the recommended integration method for accessing multiple re - **Account permissions**: - Email addresses (Read) -4. **Generate Private Key** +4. **Where can this GitHub App be installed?** + - Select "Any account" to be able to install the GitHub App in any organization. + +5. **Generate Private Key** - Scroll to the "Private keys" section after app creation - Click "Generate a private key" - Download the `.pem` file and store securely diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 34d7dea22b..9ced1b7941 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -33,6 +33,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - GitHub App authentication for GitHub provider [(#8529)](https://github.com/prowler-cloud/prowler/pull/8529) - List all accessible organizations in GitHub provider [(#8535)](https://github.com/prowler-cloud/prowler/pull/8535) - Only evaluate enabled accounts in `entra_users_mfa_capable` check [(#8544)](https://github.com/prowler-cloud/prowler/pull/8544) +- GitHub Personal Access Token authentication fails without `user:email` scope [(#8580)](https://github.com/prowler-cloud/prowler/pull/8580) --- diff --git a/prowler/providers/github/github_provider.py b/prowler/providers/github/github_provider.py index f82772e1d8..46dff4ab09 100644 --- a/prowler/providers/github/github_provider.py +++ b/prowler/providers/github/github_provider.py @@ -351,11 +351,21 @@ class GithubProvider(Provider): g = Github(auth=auth, retry=retry_config) try: user = g.get_user() + # Try to get email if the token has the necessary scope + account_email = None + try: + emails = user.get_emails() + if emails: + account_email = emails[0].email + except Exception: + # Token doesn't have user:email scope or other API error + pass + identity = GithubIdentityInfo( account_id=user.id, account_name=user.login, account_url=user.url, - account_email=user.get_emails()[0].email, + account_email=account_email, ) return identity @@ -405,9 +415,14 @@ class GithubProvider(Provider): report_lines = [ f"GitHub Account: {Fore.YELLOW}{self.identity.account_name}{Style.RESET_ALL}", f"GitHub Account ID: {Fore.YELLOW}{self.identity.account_id}{Style.RESET_ALL}", - f"GitHub Account Email: {Fore.YELLOW}{self.identity.account_email}{Style.RESET_ALL}", - f"Authentication Method: {Fore.YELLOW}{self.auth_method}{Style.RESET_ALL}", ] + if self.identity.account_email: + report_lines.append( + f"GitHub Account Email: {Fore.YELLOW}{self.identity.account_email}{Style.RESET_ALL}" + ) + report_lines.append( + f"Authentication Method: {Fore.YELLOW}{self.auth_method}{Style.RESET_ALL}" + ) elif isinstance(self.identity, GithubAppIdentityInfo): report_lines = [ f"GitHub App ID: {Fore.YELLOW}{self.identity.app_id}{Style.RESET_ALL}",