Connect GitHub

GitHub is the world's leading platform for software development, version control, and collaboration. The GitHub integration imports your organization or enterprise billing data — including GitHub Actions, Copilot, Packages, and more — into Cloud Intelligence so you can analyze GitHub costs in Cloud Analytics.

Prerequisites

Before you begin, make sure you have the following:

• A GitHub organization or enterprise account with Owner permissions.

• A DoiT account with the Billing Profiles Admin permission.

Connection overview

The GitHub integration supports two connection levels:

Connection level	Scope	Best for
Organization	A single GitHub organization	Teams managing one organization
Enterprise	An entire GitHub enterprise (includes all organizations)	Enterprises with multiple organizations

DoiT connects to GitHub with an OAuth app. The OAuth connection is the only required part and covers billing data, Copilot usage metrics, and member identities. Optionally, after you finish the OAuth connection, you can install the DoiT GitHub App to add Copilot seat assignments and GitHub Advanced Security data. See Required permissions and Enable enriched data with the GitHub App.

Required permissions

GitHub roles

The GitHub user who selects Connect with GitHub must be:

• Organization connection: an Owner of the organization.

• Enterprise connection: an Owner of the enterprise.

GitHub restricts the billing and Copilot usage metrics APIs to these roles. For example, GitHub documents the organization usage reports as available to an administrator of the organization, and the organization Copilot usage metrics to organization owners. See the GitHub REST API documentation for billing usage and Copilot usage metrics.

Member identities (GitHub login and verified-domain email) are returned for an organization only when the connecting user is an owner of that organization. For an enterprise connection, the user must be an owner of each organization whose member emails you want in DoiT.

OAuth scopes

DoiT requests two OAuth scopes. The scopes are the same for both connection levels.

Scope	Used for
admin:org	Organization data: billing usage reports, Copilot usage metrics, and member identities.
read:enterprise	Enterprise data: the same reports, plus the list of the enterprise's organizations and members.

GitHub describes admin:org as a broad scope. The DoiT integration sends only GET requests and GraphQL queries to GitHub; it sends no GraphQL mutations.

What the optional GitHub App adds

The OAuth connection does not need the GitHub App. Without the App you do not get:

• Copilot seat assignments.
• GitHub Advanced Security committer counts.
• Member identities for installations where the OAuth connection returns no members.

Install the App as described in Enable enriched data with the GitHub App.

Connect your GitHub account

Step 1: Start the connection wizard

1. Sign in to Cloud Intelligence, select Data ingestion and integrations > Integrations from the top navigation mega menu.

2. Search for GitHub in the integrations catalog.

3. Select Connect + on the integration card.

Step 2: Choose your connection level

1. Select the Connection Level:

   • Organization — connect a single GitHub organization.
   • Enterprise — connect an entire GitHub enterprise account.

2. Enter your Org or Enterprise Slug. This is the URL-friendly name of your organization or enterprise (e.g. my-company).

   Tip

   You can find your organization slug in the URL when viewing your GitHub organization: github.com/ my-company. For enterprise accounts, navigate to github.com/enterprises/ my-company.

Step 3: Authorize with OAuth

1. Select Connect with GitHub to begin the OAuth flow. You will be redirected to GitHub to sign in (if not already signed in) and grant DoiT access to your billing data.

2. Review the requested permissions and select Authorize.

   DoiT requests the following OAuth scopes:

   • admin:org — read organization billing and usage data.
   • read:enterprise — read enterprise billing data (for enterprise connections).

   After authorization, you are redirected back to Cloud Intelligence.

Step 4: Test and save

1. Select Test connection to verify DoiT can access your GitHub billing data.

2. If the test is successful, select Save to complete the setup.

   If the test fails or you need further assistance, please open an expert inquiry.

Note

Upon initial connection, DoiT ingests up to 90 days of historical billing data. The import process can take a few hours. You'll receive an email when the data is available in Cloud Analytics.

Optional: Enable enriched data with the GitHub App

For deeper visibility into Copilot seats and GitHub Advanced Security, install the optional DoiT GitHub App after you complete the OAuth connection. The App is not needed for billing data or Copilot usage metrics.

The GitHub App provides access to:

• Copilot seat assignments: See which users have Copilot licenses.
• GitHub Advanced Security: View GHAS committer counts per repository.

1. Sign in to Cloud Intelligence, select Data ingestion and integrations > Integrations from the top navigation mega menu.

2. Search for GitHub in the integrations catalog.

3. Select Manage on the integration card.

4. In the connections table, locate the Supplementary data column for the connection you want to enrich.

5. Select Connect to start the GitHub App installation flow.

6. Complete the installation and approval steps on GitHub. When you return to DoiT, the Supplementary data column displays Connected.

Troubleshooting

Organization has OAuth App access restrictions

GitHub organizations can restrict which OAuth apps may read the organization's data. When an organization has this setting on and has not approved the DoiT OAuth app, GitHub refuses DoiT's requests for that organization's data, even though the user who connected is an owner or member and authorized the app.

What you see

DoiT sends a GitHub sync failure e-mail. The Endpoint line names the failed data source, for example enterprise_member_identities, and the Reason line says that GitHub OAuth app access is restricted and that an organization owner must approve the integration.

The e-mail does not name the organization. It reports one failed request, so it does not list every affected organization. An enterprise can contain several organizations with restrictions, and each one needs approval.

Why it happens

OAuth app access restrictions are a setting of each GitHub organization. GitHub turns the setting on by default for new organizations. When it is on, an OAuth app has no access to the organization's data until an organization owner approves the app. GitHub's documentation describes this setting only at the organization level. See About OAuth app access restrictions.

Fix it as an organization owner

Repeat these steps in every organization whose members or data DoiT should read.

1. On GitHub, select your profile picture, then select Organizations.

2. Select the organization.

3. Under the organization name, select Settings.

4. In the Third-party Access section of the sidebar, select OAuth app policy.

5. Next to the DoiT OAuth app, select Review. The app is listed under the name that GitHub showed on the authorization screen in step 3.

6. Review the request, then select Grant access.

If the app is not listed, a member has not requested approval yet. Ask the user who connected GitHub to DoiT to request approval, as described in the next section. GitHub's instructions: Approving OAuth apps for your organization.

Fix it as a user who is not an organization owner

The DoiT OAuth app must first be authorized for your personal GitHub account, which step 3 of the connection does. Then, for each restricted organization:

1. On GitHub, select your profile picture, then select Settings.

2. In the Integrations section of the sidebar, select Applications.

3. Select the Authorized OAuth Apps tab.

4. Select the DoiT OAuth app.

5. Next to the organization, select Request access.

6. Review the information, then select Request approval from owners.

An owner of the organization then approves the request with the steps above. GitHub's instructions: Requesting organization approval for OAuth apps.

After approval, DoiT retries on its next refresh, which runs every 6 hours. If failure e-mails continue after an owner has approved the app in every organization, open an expert inquiry.

Data refresh

DoiT refreshes your GitHub billing data every 6 hours. Billing data typically becomes available within 24–26 hours of being generated by GitHub.

Reporting dimensions

Once connected, GitHub billing data maps to the following standard Cloud Analytics dimensions:

Cloud Analytics dimension	GitHub value	Example
Provider	GitHub	GitHub
Billing Account	Organization or enterprise name	my-company
Project/Account ID	Repository or organization name	my-company/api-service
Service	GitHub product name	actions, copilot, packages, codespaces
SKU	Usage SKU	actions_linux_4_core, copilot_business

In addition to standard dimensions, the following GitHub-specific labels are available:

Label	Description
Organization	The GitHub organization name
Repository	The repository associated with the cost
User	The user associated with the usage (when available)
Product	GitHub product (e.g. Actions, Copilot, Packages, Codespaces)
Model	The AI model used (for Copilot premium requests)

Tip

To filter Cloud Analytics reports to only Copilot spending, use the Product label with the value Copilot.

Delete your GitHub connection

1. Sign in to Cloud Intelligence, select Data ingestion and integrations > Integrations from the top navigation mega menu.

2. Search for GitHub in the integrations catalog.

3. Select Manage on the integration card.

4. Select the kebab menu (⋮) at the rightmost end of the GitHub account you want to remove and select Delete.

5. Select Delete to confirm.

Removing the integration also revokes the OAuth token and uninstalls the GitHub App (if installed). All previously imported GitHub cost data will be removed from Cloud Intelligence.