Skip to content

GitHub code ownership

GitHub supplies repository, team, and ownership metadata so Venturi can connect AI-assisted engineering activity to the teams responsible for the codebase.

Onboarding scope

This guide covers the read-only github connector in the Venturi platform connector package: organization, repository, ownership, and Copilot usage metadata. It does not grant Venturi write access to repositories, issues, pull requests, packages, deployments, or Actions.

Required access

Grant these GitHub App permissions. They are vendor permissions, shown with GitHub’s console labels:

GitHub App permission Purpose
Organization permissions → Members: Read-only Map users and teams to the customer tenant.
Repository permissions → Metadata: Read-only Enumerate repositories and basic repository metadata.
Repository permissions → Contents: Read-only Read CODEOWNERS files for ownership mapping.
Repository permissions → Webhooks: Read-only Read the repository webhook inventory.
Organization permissions → GitHub Copilot Business: Read-only Read Copilot seat assignments.
Organization permissions → Organization Copilot metrics: Read-only Read Copilot usage metrics reports.
Repository permissions → Pull requests: Read-only Optional; adds review and ownership context.

Do not grant write permissions. The Contents permission can read any file in the selected repositories; the connector reads only the standard CODEOWNERS paths (CODEOWNERS, .github/CODEOWNERS, docs/CODEOWNERS), reduces them to ownership records in memory, and never stores source code.

Use a GitHub App. If you cannot install one, a fine-grained personal access token with the same read-only permissions also works. Do not use a classic personal access token: its repo scope grants read and write access to repository code and webhooks. See GitHub’s GitHub App permission reference, fine-grained token permission reference, OAuth scope reference, and Copilot usage metrics API.

Setup

  1. Create or install the Venturi GitHub App in the target organization with the permissions above.
  2. Restrict repository access to the repositories you want Venturi to analyze.
  3. Confirm every granted permission is Read-only.
  4. In Venturi, go to Integrations / GitHub.
  5. Select the installation and run Test connection.
  6. Confirm the first sync shows organization, repository, and team counts.

Each sync reads the organization inventory (members, teams, repositories, webhooks, and CODEOWNERS ownership) in full, so no time lookback applies. Copilot usage comes from GitHub’s 28-day organization metrics report. See sync windows and failure behavior.

Verification

  • Test connection passes the read-only boundary check: organization, repository, team, and Copilot reads succeed, and the installation holds no write permission.
  • Repository counts match the installation scope you selected.
  • Teams and ownership records appear in the attribution graph.
  • The connector inventory marks GitHub as read-only.
  • The Attribution detail page shows GitHub ownership evidence for engineering usage where such evidence exists.

Rotation and offboarding

For GitHub App installations, rotate the app’s private key through the app settings and update the credential reference in Settings / Admin / Credentials. For a fine-grained personal access token, rotate it before it expires through your normal privileged-access process and update the credential reference. Removing the connector stops new ownership syncs but does not delete historical attribution evidence.

Give feedback on this page

Sign in to send feedback. Opens in a new tab.

Copy page details 
Docs feedback: GitHub code ownership
Page: https://docs.venturi.systems/connectors/github/