Skip to main content

Check out Port for yourself ➜ 

Installation

This page details how to install Port's GitHub integration (powered by the Ocean framework).

This page outlines the following steps:

  1. How to create an access token to give the integration permissions to query your GitHub organization.
  2. How to deploy the integration in the configuration that fits your use case.

Prerequisites​

  • A GitHub account with permissions to create access tokens.
  • Your Port user role is set to Admin.

Setup​

Create access token​

To allow Port to fetch data from your GitHub Organization(s), you need to create an access token. Port supports two types of tokens for authentication: personal access tokens and GitHub app installation tokens.

A Personal Access Token (PAT) is suitable if you are the only one managing the integration and don't need frequent credential rotation.
To create a personal access token see GitHub's managing your personal access tokens.

The token must belong to a user with access to the relevant GitHub resources (e.g., repositories, teams) across all organizations you want to sync.

You will use this token as the githubToken parameter when deploying the integration below.

Required permissions (click to expand)

These are the necessary permissions if you're creating a fine-grained PAT.

Repository permissions:

  • Content: Readonly (For reading files)
  • Metadata: Readonly
  • Administration: Readonly (for syncing repository teams and collaborators)
  • Pull Requests: Readonly
  • Issues: Readonly
  • Actions: Readonly
  • Code scanning alerts: Readonly
  • Dependabot alerts: Readonly
  • Deployments: Readonly
  • Environments: Readonly

Organization permissions:

  • Members: Readonly(for syncing users and teams)
  • Administration: Readonly(for syncing external identities)
  • Webhooks: Read and Write (for managing webhook)
Default permissions

You will be prompted to confirm the above listed permissions when creating a personal access token.

Permissions can be given to selected repositories in your organization, or to all repositories.
You can reconfigure the permission at any time, giving it access to new repositories, or removing access.

Configure parallel processing​

Configure multiple workers to handle GitHub webhook events in parallel groups, preventing race conditions while maintaining event ordering for related resources.

Starting with Ocean 0.27, a new parameter was added to the configuration, which adjusts the number of async workers spawned for webhook events.

Set event_workers_count: 4 in your config (default: 1) to enable parallel group processing.

When event_workers_count > 1, related GitHub events get grouped together:

  • All PR events (opened, review, status) for PR #123 → same processing group.
  • All issue events for issue #456 → same processing group.
  • Push events grouped by commit SHA.
Event grouping behavior (click to expand)

Supported event types:

  • Pull Requests: Grouped by PR number (pull_request, pull_request_review, pull_request_review_comment)
  • Issues: Grouped by issue number (issues, issue_comment)
  • Pushes: Grouped by commit SHA (push)
  • Releases: Grouped by release ID (release)
  • Workflow Runs: Grouped by run ID (workflow_run)
  • Status Checks: Grouped by commit SHA (status)

Fallback: If the event type isn't recognized, the payload will be scanned for the first number, id, or sha field.

Processing guarantees

Events within the same group are processed sequentially to maintain order and prevent conflicts. Different groups can be processed in parallel across workers. With event_workers_count: 1, all events are processed sequentially using a simple queue.

Deploy the integration​

To deploy the integration, you will need your Port CLIENT_ID and CLIENT_SECRET.

To get your Port credentials, go to your Port application, click on the ... button in the top right corner, and select Credentials. Here you can view and copy your CLIENT_ID and CLIENT_SECRET:

Choose the installation method that best suits your needs:

Using this installation option means that the integration will be hosted by Port, with a customizable resync interval to ingest data into Port.

Live event support

This integration supports live events, allowing real-time updates to your software catalog without waiting for the next scheduled sync.

Supported live event triggers (click to expand)

repository:

  • created
  • edited
  • renamed
  • transferred
  • unarchived
  • publicized
  • privatized
  • archived
  • deleted

pull_request:

  • opened
  • edited
  • ready_for_review
  • reopened
  • synchronize
  • unassigned
  • review_request_removed
  • closed

issues:

  • assigned
  • closed
  • demilestoned
  • edited
  • labeled
  • locked
  • milestoned
  • opened
  • pinned
  • reopened
  • transferred
  • typed
  • unassigned
  • unlabeled
  • unlocked
  • unpinned
  • untyped
  • deleted

release:

  • created
  • edited
  • deleted

create

delete

push

deployment

deployment_status

workflow_run:

  • in_progress
  • requested
  • completed

dependabot_alert:

  • created
  • reopened
  • auto_reopened
  • reintroduced
  • dismissed
  • auto_dismissed
  • fixed

code_scanning_alert:

  • appeared_in_branch
  • reopened
  • created
  • fixed
  • closed_by_user

organization:

  • member_added
  • member_removed

team:

  • created
  • edited
  • deleted
  • added_to_repository

membership:

  • added
  • removed

member:

  • added
  • edited
  • removed

secret_scanning_alert:

  • created
  • publicly_leaked
  • reopened
  • validated
  • resolved
Self-hosted installation

Alternatively, you can install the integration using the Self-hosted method to update Port in real time using webhooks.

Installation

To install, follow these steps:

  1. Go to the Data sources page of your portal.

  2. Click on the + Data source button in the top-right corner.

  3. Click on the relevant integration in the list.

  4. Under Select your installation method, choose Hosted by Port.

  5. Configure the integration settings and application settings as you wish (see below for details).

Application settings

Every integration hosted by Port has the following customizable application settings, which are configurable after installation:

  • Resync interval: The frequency at which Port will ingest data from the integration. There are various options available, ranging from every 1 hour to once a day. If a sync is still in progress when the next one is due, the new sync will be skipped (up to 24 hours delay).
    This ensures that all kinds are fully synchronized and that cleanup of stale entities always takes place at the end of each sync.

  • Send raw data examples: A boolean toggle (enabled by default). If enabled, raw data examples will be sent from the integration to Port. These examples are used when testing your mapping configuration, they allow you to run your jq expressions against real data and see the results.

Integration settings

Every integration has its own tool-specific settings, under the Integration settings section.
Each of these settings has an ⓘ icon next to it, which you can hover over to see a description of the setting.

Port secrets

Some integration settings require sensitive pieces of data, such as tokens.
For these settings, Port secrets will be used, ensuring that your sensitive data is encrypted and secure.

When filling in such a setting, its value will be obscured (shown as ••••••••).
For each such setting, Port will automatically create a secret in your organization.

To see all secrets in your organization, follow these steps.

Limitations

  • The maximum time for a full sync to run is based on the configured resync interval. For very large amounts of data where a resync operation is expected to take longer, please use a longer interval.

Port source IP addresses

When using this installation method, Port will make outbound calls to your 3rd-party applications from static IP addresses.
You may need to add these addresses to your allowlist, in order to allow Port to interact with the integrated service:

54.73.167.226  
63.33.143.237  
54.76.185.219

Multi GitHub organization support​

Starting from version 3.0.0-beta, the GitHub integration supports syncing data from multiple GitHub organizations.

Configuration:

  • GitHub App or fine-grained PAT: Use githubOrganization to specify a single organization.
  • Classic PAT:
    • Specify organizations in your port mapping using organizations: ["org1", "org2", "org3"].
    • If organizations is not specified, the integration syncs all organizations the classic PAT has access to.
Multi-organization mapping example (click to expand)
deleteDependentEntities: true
createMissingRelatedEntities: true
enableMergeEntity: true
organizations:
  - org1
  - org2
# ... rest of your mapping (repositoryType, resources, etc.) ...

Precedence:

If githubOrganization is set in the environment variables or config and organizations are also listed in the port mapping, the integration prioritizes single-organization behavior and syncs only the githubOrganization.

Performance considerations:

Syncing multiple organizations increases the number of API calls to GitHub and may slow down the integration. The more organizations you sync, the longer the resync time and the higher the API rate limit consumption.

Default mapping behavior:

First-time installs may sync more data than intended if organizations are not scoped. After installation, review your mapping configuration to ensure only the required organizations are included.