> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect GitHub with GitHub App (GHE.com) – StackOne Hub

> Link a GitHub account in the StackOne Hub using GitHub App (GHE.com). End-user guide to authorize the integration and start using GitHub actions.

> [!WARNING]
>
> Connect as an owner of each organization StackOne should read, because members cannot read the organization audit log. If your enterprise uses an IP allow list, it must allow [StackOne's IP addresses](https://docs.stackone.com/connect/troubleshooting.md#connection-issues-behind-a-firewall). If your identity provider's Conditional Access policy limits IP addresses, it must allow them too.

Select Actions to adjust the guideSome actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.

Select all
Clear

ActionScope(s)

Loading actions...No actions match your search.

Dynamic Guide URL

Copy URL

Scopes Selected

<pre role="textbox" aria-readonly="true" tabIndex="0" />

Separator

Copy scopes

## Find your GHE.com subdomain

The **GHE.com subdomain** is the part before `.ghe.com` in your enterprise's address.

<ul>
  <li>Format: `https://<subdomain>.ghe.com`</li>
  <li>Example: if your address is `https://acme.ghe.com`, your subdomain is `acme`</li>
</ul>

## Register a GitHub App in your enterprise

Create the app inside the GHE.com enterprise you are connecting, signed in as an organization owner.

**1. Start a new GitHub App**

Sign in to `https://<subdomain>.ghe.com`, then open **Settings** > **Developer settings** > **GitHub Apps**.

<ul>
  <li>Click **New GitHub App**.</li>
</ul>

**2. Fill in the basic information**

Name the app at the top of the form.

<ul>
  <li>**GitHub App name**: `StackOne`</li>
  <li>**Homepage URL**: your company's website</li>
</ul>

**3. Set up user authorization**

Fill in the **Identifying and authorizing users** section.

<ul>
  <li>**Redirect URI**: copy it from your Connector Profile</li>
  <li>Leave **Expire user authorization tokens** selected.</li>
  <li>Leave **Request user authorization (OAuth) during installation** cleared.</li>
</ul>

**4. Turn off the webhook**

Under **Webhook**, clear **Active**.

**5. Set permissions for user access reviews**

Enables actions: Check Organization Membership, Get Authenticated User, Get Branch, Get Branch Rules, Get Organization, Get Organization Membership, Get Repository, Get Repository Ruleset, Get Team, Get Unified Credentials, Get Unified Group, Get Unified Organization, Get Unified Role, Get User, List Authenticated User Organizations, List Authenticated User Repositories, List Branches, List Collaborators, List Forks, List Organization Branch Protection, List Organization Members, List Organization Members With Two-Factor Status, List Organization Repositories, List Outside Collaborators, List Repository Rulesets, List Team Members, List Team Repositories, List Teams, List Unified Groups, List Unified Organizations, List Unified Roles, List Unified Users, List User Organizations, List User Repositories, List Users, Search Code, Search Issues, Search Repositories

Set each of these to **Read-only**. **Metadata** is already **Read-only**.

<ul>
  <li>**Organization permissions** > **Members**</li>
  <li>**Account permissions** > **Email addresses**</li>
</ul>

<ul>
  <li>
    MembersRead
  </li>

  <li>
    MetadataRead
  </li>

  <li>
    EmailAddressesRead
  </li>
</ul>

**6. Add permissions for compliance checks**

Enables actions: Create Pull Request, Create Pull Request Review, Create Pull Request Review Comment, Get Branch, Get Branch Protection, Get Combined Status For Ref, Get Commit, Get Git Reference, Get Latest Release, Get Organization Ruleset, Get Pull Request, Get Repository, Get Repository Content, List Authenticated User Repositories, List Branches, List Check Runs For Ref, List Commits, List Forks, List Matching Git References, List Organization Audit Log, List Organization Branch Protection, List Organization Repositories, List Organization Rulesets, List Pull Request Reviews, List Pull Requests, List Pull Requests For Commit, List Releases, List Repository Teams, List User Repositories, Merge Pull Request, Search Code, Search Issues, Search Pull Requests With Reviews, Search Repositories, Update Organization, Update Pull Request

Set each repository permission to **Read-only**, and choose the access for organization **Administration**.

<ul>
  <li>**Organization permissions** > **Administration**: **Read-only**, or **Read and write** to also read organization rulesets</li>
  <li>**Repository permissions** > **Administration**</li>
  <li>**Repository permissions** > **Contents**</li>
  <li>**Repository permissions** > **Pull requests**</li>
  <li>**Repository permissions** > **Checks**</li>
  <li>**Repository permissions** > **Commit statuses**</li>
</ul>

<ul>
  <li>
    OrganizationAdministrationRead
  </li>

  <li>
    OrganizationAdministrationWrite
  </li>

  <li>
    AdministrationRead
  </li>

  <li>
    ContentsRead
  </li>

  <li>
    PullRequestsRead
  </li>

  <li>
    ChecksRead
  </li>

  <li>
    CommitStatusesRead
  </li>
</ul>

**7. Add permissions for other actions**

Enables actions: Add Collaborator, Add Team Member, Add Team Repository, Cancel Workflow Run, Create Deployment, Create Deployment Status, Create Git Reference, Create Issue, Create Issue Comment, Create Or Update File, Create Organization Repository, Create Pull Request, Create Pull Request Review, Create Pull Request Review Comment, Create Release, Create Team, Create User Repository, Create Webhook, Delete Deployment, Delete File, Delete Git Reference, Delete Release, Delete Repository, Delete Team, Delete Webhook, Download Artifact, Fork Repository, Get Authenticated User, Get Branch, Get Branch Protection, Get Combined Status For Ref, Get Commit, Get Git Reference, Get Issue, Get Latest Release, Get Organization Ruleset, Get Pull Request, Get Repository, Get Repository Content, Get Unified Credentials, Get Webhook, Get Workflow Run, List Artifacts, List Authenticated User Repositories, List Branches, List Check Runs For Ref, List Code Scanning Alerts, List Commits, List Dependabot Alerts, List Deployments, List Forks, List Issue Comments, List Issues, List Matching Git References, List Organization Audit Log, List Organization Branch Protection, List Organization Repositories, List Organization Rulesets, List Pull Request Reviews, List Pull Requests, List Pull Requests For Commit, List Releases, List Repository Teams, List Secret Scanning Alerts, List User Repositories, List Webhooks, List Workflow Jobs, List Workflow Runs, Merge Pull Request, Ping Webhook, Re-run Workflow, Remove Collaborator, Remove Organization Member, Remove Team Member, Search Code, Search Issues, Search Pull Requests With Reviews, Search Repositories, Star Repository, Trigger Workflow, Unstar Repository, Update Code Scanning Alert, Update Dependabot Alert, Update Git Reference, Update Issue, Update Organization, Update Pull Request, Update Release, Update Repository, Update Secret Scanning Alert, Update Team, Update User, Update Webhook

Add these only for the actions you plan to use.

<ul>
  <li>
    ProfileRead
  </li>

  <li>
    ActionsRead
  </li>

  <li>
    ActionsWrite
  </li>

  <li>
    AdministrationRead
  </li>

  <li>
    AdministrationWrite
  </li>

  <li>
    ContentsRead
  </li>

  <li>
    ContentsWrite
  </li>

  <li>
    DeploymentsRead
  </li>

  <li>
    DeploymentsWrite
  </li>

  <li>
    IssuesRead
  </li>

  <li>
    IssuesWrite
  </li>

  <li>
    MembersWrite
  </li>

  <li>
    OrganizationAdministrationRead
  </li>

  <li>
    OrganizationAdministrationWrite
  </li>

  <li>
    ProfileWrite
  </li>

  <li>
    PullRequestsRead
  </li>

  <li>
    PullRequestsWrite
  </li>

  <li>
    SecurityEventsRead
  </li>

  <li>
    WebhooksRead
  </li>

  <li>
    WebhooksWrite
  </li>

  <li>
    ChecksRead
  </li>

  <li>
    CommitStatusesRead
  </li>

  <li>
    CodeScanningAlertsWrite
  </li>

  <li>
    DependabotAlertsWrite
  </li>

  <li>
    SecretScanningAlertsWrite
  </li>

  <li>
    StarringWrite
  </li>

  <li>
    WorkflowsWrite
  </li>
</ul>

**8. Create the app**

At the bottom of the form, find **Where can this GitHub App be installed?**.

<ul>
  <li>Select **This enterprise**.</li>
  <li>Click **Create GitHub App**.</li>
</ul>

**9. Copy the credentials**

Both credentials are on the app's page.

<ul>
  <li>Copy the **Client ID** across.</li>
  <li>Under **Client secrets**, click **Generate a new client secret**.</li>
  <li>Copy the **Client Secret** across. GitHub shows it only once.</li>
</ul>

**10. Install the app**

In the app's sidebar, open **Install App**.

<ul>
  <li>Click **Install** next to each organization StackOne should read.</li>
  <li>Select **All repositories**.</li>
  <li>Click **Install**.</li>
</ul>

## Find your organization ID

The **Organization ID** is the organization name in your organization's address on GHE.com.

<ul>
  <li>Format: `https://<subdomain>.ghe.com/<organization ID>`</li>
  <li>Example: if the organization's address is `https://acme.ghe.com/acme-engineering`, the organization ID is `acme-engineering`</li>
</ul>

## What GitHub reports for managed users

Managed users sign in and use two-factor authentication through your identity provider, so the two-factor status GitHub shows for them is always off.

## Link the Account

**1. Connect**

<ul>
  <li>Click **Connect**.</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup.</li>
</ul>

**2. Use Actions**

Connect an AI platform to the linked account's actions. See [AI Platforms](https://docs.stackone.com/connect/ai-platforms/overview.md).

Other ways to call actions are listed in [Protocols & SDKs](https://docs.stackone.com/connect/protocols-and-sdks.md).

## Next Steps

> [card] [Webhooks setup](https://docs.stackone.com/connectors/github/guides/webhook-setup.md)
>
> Configure receiving Events for GitHub into StackOne.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.