# GitHub

> Branch protection, reviews and access. Prerequisites, setup steps and troubleshooting.

Source: https://docs.csquaregrc.com/connectors/github

## What it does

GitHub evidence covers branch protection, review requirements and access, which is what most change-management controls actually ask for.

## Prerequisites

- A cSquare GRC workspace where you are an **owner** or **admin**.
- Connection method: **API key or token**.
- Access needed at GitHub: Read-only on repositories and org membership.

## Set up

Open **Settings > Integrations** in [the app](https://app.csquaregrc.com), find GitHub, then:

1. Create a fine-grained personal access token, or a GitHub App installation token, scoped to the organization you want monitored.
2. Grant read access to repository administration, contents metadata and organization members.
3. Paste the token and the organization login here.

## Verify the connection

1. Back in **Settings > Integrations**, GitHub should show **Connected** with a recent sync time.
2. Open **Evidence** and filter by source **GitHub**. The first sync can take a few minutes.
3. Open a control that depends on GitHub and confirm the new evidence is linked.

## AI prompts

Paste these into Fibo in the app, or into any assistant connected through [MCP](/mcp/connect).

```text
I just connected GitHub to cSquare GRC. Check that it is syncing, list the evidence it has collected so far, and tell me which controls in my active programs now have evidence from GitHub.
```

```text
Which controls in my programs could be covered by GitHub evidence but still have no current evidence? Group them by framework and suggest what to collect.
```

## Troubleshooting

### Repositories missing from collection

Fine-grained tokens only see repositories you explicitly selected. Re-issue the token with all repositories, or add the missing ones.

### 404 on the organization

Use the organization login from the URL, not its display name.

### Test connection fails immediately

Nine times out of ten the credential was pasted with a trailing space, or it was issued in a different tenant or region. Re-copy it and try again.

### The connector is quarantined

Collection paused after three consecutive failures. Fix the credential, then use Re-test and re-enable on the Active connections tab; it only resumes when the test passes.

### Connected, but no evidence appears

Check that at least one collection type is selected and that the account can see the resources. Read-only accounts scoped to a single project will only return that project.

### Still stuck?

```text
My GitHub connector in cSquare GRC is failing. Here is the error I see: <paste error>. Walk me through the likely causes and the exact fix, step by step.
```