GitHub is currently supported as a data source via the Worklytics Pseudonymization Proxy.

Linking GitHub Accounts to Other Data Sources

GitHub users are identified by usernames, which for cloud editions of GitHub are not related to the organization-issued email for an employee. Additionally, some customers connect both on-prem and cloud versions of GitHub to Worklytics, creating the possibility that a given user should be associated with an identity in both systems.

GITHUB_USERNAME / GITHUB_USERNAME_ALT in HRIS data

Our recommended approach, if you have GitHub Username readily available in your HRIS data, is to provide it to Worklytics in your HRIS snapshot data.

Alternatively, if the GitHub Usernames are deterministically derived from the email address, you can configure the Pseudonymization Proxy to add the GITHUB_USERNAME column to your HRIS data when it processes it. The common case of this is that the GitHub username is derived from the mailbox portion of the email address, e.g. for user alice@acme.com, the GitHub username would be alice_acme. The following rules would instruct the pseudonymization service to perform the equivalent transform, and then pseudonymize the result and add it to your HRIS data:

custom_bulk_connector_rules = {
  hris = {
    "columnsToPseudonymize": [
      "employee_id",
      "employee_email",
      "manager_id"
    ]
    "columnsToPseudonymizeIfPresent": [
      "manager_email"
    ]
    fieldsToTransform: {
      "employee_email": {
        newName: "GITHUB_USERNAME"
        transforms: [
          {
            filter : "(.*)@.*"
          },
          {
            formatString: "%s_acme"
          },
          {
            pseudonymize: true
          }
        ]
      }
    }
  }
}

Other scenarios are also possible; please contact Worklytics support for assistance.

GitHub User.email

The User.email field in the GitHub API exposes the public email address associated with the user. Typically, this is an alias like {username}@no-reply.github.com, which does not facilitate user identification across other systems. However, if a standard email address is provided instead, Worklytics will attempt to link it to other data sources.

NameID in SAML

If your organization uses SAML to authenticate users for membership in your GitHub organization, we will attempt to use the NameID value associated with each user as an email address to link across data sources. (Many organizations provide email address the NameID in SAML payloads to authenticate their users into 3rd party systems)

See:

https://docs.github.com/en/enterprise-cloud@latest/admin/managing-iam/iam-configuration-reference/saml-configuration-reference#saml-attributes

The following table(s) contains detailed examples of the metadata fields available from the GitHub API endpoints Worklytics leverages. In order to pseudonymize and sanitize PII and other potentially sensitive data, Worklytics provides access to a Data Loss Prevention (DLP) Proxy, which allows customers to pre-filter metadata, within customer infrastructure, before it is sent to Worklytics for processing.

These are the fields Worklytics recommends but the Worklytics DLP Proxy provides full field-level control and therefore any field may be removed or sanitized.

Field descriptions are taken from third party API documentation, these are maintained on a best effort basis and Worklytics can not guarantee their indefinite accuracy. Please refer to the source API site for the most up-to-date documentation.

To see only the fully sanitized version of this document, click here.

Worklytics requires access to the following API primary endpoints:

User

API docs: https://docs.github.com/en/rest/orgs/members?apiVersion=2022-11-28#list-organization-members

DLP Proxy docs: GitHub

Branch

API docs: https://docs.github.com/en/rest/reference/repos#branches

DLP Proxy docs: GitHub

PullReview

API docs: https://docs.github.com/en/rest/pulls/reviews?apiVersion=2022-11-28#list-reviews-for-a-pull-request

DLP Proxy docs: GitHub

IssueComment

API docs: https://docs.github.com/en/rest/issues/comments?apiVersion=2022-11-28#list-issue-comments-for-a-repository

DLP Proxy docs: GitHub

IssueTimelineEvent

API docs: https://docs.github.com/en/rest/issues/timeline

DLP Proxy docs: GitHub

Team

API docs: https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams

DLP Proxy docs: GitHub

Organization

API docs: https://docs.github.com/en/graphql/reference/objects#organization

DLP Proxy docs: GitHub

AuditLog

API docs: https://docs.github.com/en/enterprise-cloud@latest/rest/orgs/orgs?apiVersion=2022-11-28#get-the-audit-log-for-an-organization

DLP Proxy docs: GitHub

Pull

API docs: https://docs.github.com/en/rest/pulls/pulls?apiVersion=2022-11-28#list-pull-requests

DLP Proxy docs: GitHub

PullComment

API docs: https://docs.github.com/en/rest/pulls/comments?apiVersion=2022-11-28#list-comments-for-a-pull-request

DLP Proxy docs: GitHub

Commit

API docs: https://docs.github.com/en/rest/commits/commits?apiVersion=2022-11-28

DLP Proxy docs: GitHub

MembersWithRole

API docs: https://docs.github.com/en/graphql/reference/objects#organization

DLP Proxy docs: GitHub

Repository

API docs: https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28

DLP Proxy docs: GitHub

Issue

API docs: https://docs.github.com/en/rest/issues/issues

DLP Proxy docs: GitHub

Event

API docs: https://docs.github.com/en/webhooks-and-events/events/github-event-types#event-object-common-properties

DLP Proxy docs: GitHub