cartography
cartography copied to clipboard
feat(github): Add GitHub Actions support
Summary
Closes #2121
Adds support for GitHub Actions entities to Cartography:
- GitHubWorkflow nodes - Workflows defined in repositories
- GitHubEnvironment nodes - Deployment environments for repositories
- GitHubActionsSecret nodes - Secrets at organization, repository, and environment levels
- GitHubActionsVariable nodes - Variables at organization, repository, and environment levels
Key Features
- Uses GitHub REST API (not GraphQL) for Actions endpoints
- Supports all three levels of secrets/variables: organization, repository, and environment
- Proper rate limiting and pagination handling for REST API
- Complete schema definitions with appropriate relationships
- Secret values are never exposed (GitHub API only returns metadata)
Relationships
GitHubOrganization
|--[RESOURCE]--> GitHubActionsSecret (org-level)
|--[RESOURCE]--> GitHubActionsVariable (org-level)
GitHubRepository
|--[HAS_WORKFLOW]--> GitHubWorkflow
|--[HAS_SECRET]--> GitHubActionsSecret (repo-level)
|--[HAS_VARIABLE]--> GitHubActionsVariable (repo-level)
|--[HAS_ENVIRONMENT]--> GitHubEnvironment
|--[HAS_SECRET]--> GitHubActionsSecret (env-level)
|--[HAS_VARIABLE]--> GitHubActionsVariable (env-level)
Not addressed (future work)
The following items from #2121 are not implemented in this PR:
(GitHubWorkflow)-[:USES_SECRET]->(GitHubActionsSecret)- Parsing workflow YAML files to determine which secrets are referenced by each workflow(GitHubWorkflow)-[:USES_ACTION]->(GitHubAction)- Modeling marketplace/external actions used by workflows- "Last used" timestamps for secrets - GitHub's API does not expose this information
Checklist
- [x] I have read and agree to the Contribution Guidelines
- [x] If this is a code change, I have written unit and/or integration tests
- [x] I have updated the documentation
🤖 Generated with Claude Code