GH_Repository

A code repository in an organization, containing files, issues, and other resources

General Information

Represents a GitHub repository within the organization. Repository nodes capture metadata about the repo including visibility, Actions enablement status, and security configuration. Repository role nodes (GH_RepoRole) are created alongside each repository to represent the permission levels available.

For repositories with active workflows, the collector records the applicable default workflow permissions and whether workflows may approve pull request reviews. These properties preserve the repository-level policy input later used to derive effective GITHUB_TOKEN permissions for GH_WorkflowJob nodes.

The branch_count and environment_count properties preserve GitHub-reported totals from the repository GraphQL response. These values can be compared to collected GH_Branch and GH_Environment children to identify incomplete collection before relying on branch- or environment-dependent analysis.

Every repository is linked from its organization’s reusable repository/all GH_Scope. Private and internal repositories are also linked from repository/private_or_internal. This supports compact one- or two-hop access queries without repeating one GH_CanAccess edge per credential and repository.

Repositories also point to runner_group/all GH_Scope nodes through GH_IsEligibleFor; private and internal repositories additionally point to runner_group/private_or_internal. Those scopes enumerate canonical runner groups through GH_ScopedTo, while groups with arbitrary selected repository policies remain direct.

Organization secrets and variables with canonical all/private visibility are similarly reached through organization_secret and organization_variable scopes. Repository-owned, environment-owned, and arbitrarily selected organization assets remain direct targets.

Runner, secret, and variable boundary edges are emitted only when the organization has a matching canonical target, so empty scopes do not add per-repository edges.

Properties

Property	Type	Description
name	string	The node name used for matching and display.
displayname	string	The human-readable display name.
environmentid	string	The identifier of the GitHub environment where this node was collected.
last_seen	datetime	The timestamp when this node was last observed during collection.
node_id	string	The stable identifier used as the OpenGraph node ID; this is the native GitHub node ID where available.
collected	boolean	Collected/generated by OpenHound.
database_id	integer	The repository’s numeric GitHub database ID used in immutable OIDC subjects.
full_name	string	The fully qualified name (e.g., org/repo).
private	boolean	Whether the repository is private.
html_url	string	URL to the repository on GitHub.
description	string	The repository description.
created_at	string	When the repository was created.
updated_at	string	When the repository was last updated.
pushed_at	string	When the repository last had a push.
archived	boolean	Whether the repository is archived.
disabled	boolean	Whether the repository is disabled.
visibility	string	The visibility level: public, private, or internal.
default_branch	string	The name of the default branch (e.g., main).
size	integer	Repository size in kilobytes as reported by GitHub.
open_issues_count	integer	Number of open issues.
allow_forking	boolean	Whether forking is allowed.
web_commit_signoff_required	boolean	Whether web-based commits require sign-off.
forks	integer	Number of forks.
open_issues	integer	Number of open issues (includes pull requests).
watchers	integer	Number of watchers.
owner_name	string	The login of the repository owner.
owner_id	string	The opaque GraphQL node ID of the repository owner.
owner_database_id	integer	The numeric GitHub database ID of the repository owner used in immutable OIDC subjects.
environment_name	string	The name of the environment (GitHub organization).
actions_enabled	boolean	Whether GitHub Actions is enabled for this repository.
self_hosted_runners_enabled	boolean	Whether the repository may use self-hosted runners.
default_workflow_permissions	string	The repository’s applicable default GITHUB_TOKEN workflow permissions.
can_approve_pull_request_reviews	boolean	Whether workflows may approve pull request reviews.
secret_scanning	string	Status of secret scanning (e.g., enabled, disabled).
branch_ruleset_count	integer	Number of branch-targeted rulesets that apply to this repository.
has_branch_rulesets	boolean	Whether at least one branch-targeted ruleset applies to this repository.
branch_count	integer	Number of branch refs reported by GitHub for this repository.
environment_count	integer	Number of deployment environments reported by GitHub for this repository.
deploy_key_count	integer	Number of deploy keys reported by GitHub for this repository.
query_branches	string	Query for branches.
query_protected_branches	string	Query for protected branches.
query_branch_protection_rules	string	Query for branch protection rules.
query_roles	string	Query for roles.
query_teams	string	Query for teams.
query_workflows	string	Query for workflows.
query_runners	string	Query for runners.
query_environments	string	Query for environments.
query_secrets	string	Query for secrets.
query_variables	string	Query for variables.
query_deploy_keys	string	Query for deploy keys.
query_secret_scanning_alerts	string	Query for secret scanning alerts.
query_explicit_readers	string	Query for explicit readers.
query_unrolled_readers	string	Query for unrolled readers.
query_explicit_writers	string	Query for explicit writers.
query_unrolled_writers	string	Query for unrolled writers.

Diagram

Edges

The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions.

Inbound Edges

Edge Type	Source Node Types	Traversable
GH_AddAssignee	GH_RepoRole	❌
GH_AddLabel	GH_RepoRole	❌
GH_AdminTo	GH_RepoRole	✅
GH_BypassBranchProtection	GH_RepoRole	❌
GH_CanAccess	GH_AppInstallation, GH_DeployKey, GH_PersonalAccessToken	❌
GH_CanCreateBranch	GH_RepoRole	✅
GH_CanCreateEnvironment	GH_RepoRole	✅
GH_CanPwnRequest	GH_RepoRole	✅
GH_CloseDiscussion	GH_RepoRole	❌
GH_CloseIssue	GH_RepoRole	❌
GH_ClosePullRequest	GH_RepoRole	❌
GH_ConvertIssuesToDiscussions	GH_RepoRole	❌
GH_CreateDiscussionCategory	GH_RepoRole	❌
GH_CreateSoloMergeQueueEntry	GH_RepoRole	❌
GH_CreateTag	GH_RepoRole	❌
GH_DeleteAlertsCodeScanning	GH_RepoRole	❌
GH_DeleteDiscussion	GH_RepoRole	❌
GH_DeleteDiscussionComment	GH_RepoRole	❌
GH_DeleteIssue	GH_RepoRole	❌
GH_DeleteTag	GH_RepoRole	❌
GH_EditCategoryOnDiscussion	GH_RepoRole	❌
GH_EditDiscussionCategory	GH_RepoRole	❌
GH_EditDiscussionComment	GH_RepoRole	❌
GH_EditRepoAnnouncementBanners	GH_RepoRole	❌
GH_EditRepoCustomPropertiesValues	GH_RepoRole	❌
GH_EditRepoMetadata	GH_RepoRole	❌
GH_EditRepoProtections	GH_RepoRole	❌
GH_JumpMergeQueue	GH_RepoRole	❌
GH_ManageDeployKeys	GH_RepoRole	❌
GH_ManageDiscussionBadges	GH_RepoRole	❌
GH_ManageRepoSecurityProducts	GH_RepoRole	❌
GH_ManageSecurityProducts	GH_RepoRole	❌
GH_ManageSettingsMergeTypes	GH_RepoRole	❌
GH_ManageSettingsPages	GH_RepoRole	❌
GH_ManageSettingsProjects	GH_RepoRole	❌
GH_ManageSettingsWiki	GH_RepoRole	❌
GH_ManageTopics	GH_RepoRole	❌
GH_ManageWebhooks	GH_RepoRole	❌
GH_MarkAsDuplicate	GH_RepoRole	❌
GH_Owns	GH_Organization	✅
GH_PushProtectedBranch	GH_RepoRole	❌
GH_ReadCodeScanning	GH_RepoRole	❌
GH_ReadRepoContents	GH_RepoRole	❌
GH_RemoveAssignee	GH_RepoRole	❌
GH_RemoveLabel	GH_RepoRole	❌
GH_ReopenDiscussion	GH_RepoRole	❌
GH_ReopenIssue	GH_RepoRole	❌
GH_ReopenPullRequest	GH_RepoRole	❌
GH_RequestPrReview	GH_RepoRole	❌
GH_ResolveDependabotAlerts	GH_RepoRole	❌
GH_ResolveSecretScanningAlerts	GH_RepoRole	❌
GH_RunOrgMigration	GH_RepoRole	❌
GH_ScopedTo	GH_Scope	✅
GH_SetInteractionLimits	GH_RepoRole	❌
GH_SetIssueType	GH_RepoRole	❌
GH_SetMilestone	GH_RepoRole	❌
GH_SetSocialPreview	GH_RepoRole	❌
GH_ToggleDiscussionAnswer	GH_RepoRole	❌
GH_ToggleDiscussionCommentMinimize	GH_RepoRole	❌
GH_ViewDependabotAlerts	GH_RepoRole	❌
GH_ViewSecretScanningAlerts	GH_RepoRole	❌
GH_WriteCodeScanning	GH_RepoRole	❌
GH_WriteRepoContents	GH_RepoRole	❌
GH_WriteRepoPullRequests	GH_RepoRole	❌

Outbound Edges

Edge Type	Destination Node Types	Traversable
GH_CanDeployToEnvironment	GH_Environment	✅
GH_CanUseRunner	GH_OrgRunnerGroup, GH_RepoRunner	✅
GH_Contains	GH_Branch, GH_BranchProtectionRule, GH_DeployKey, GH_Environment, GH_RepoRunner, GH_RepoSecret, GH_RepoVariable, GH_SecretScanningAlert, GH_Workflow	❌
GH_HasSecret	GH_OrgSecret, GH_RepoSecret, GH_Scope	✅
GH_HasVariable	GH_OrgVariable, GH_RepoVariable, GH_Scope	✅
GH_IsEligibleFor	GH_OrgRunnerGroup, GH_Scope	❌

Properties

Property	Type	Description
name	str	-
displayname	str	-
environmentid	str	-
last_seen	datetime	-
node_id	str	-
collected	bool	Collected/generated by OpenHound
database_id	int | None	The repository’s numeric GitHub database ID used in immutable OIDC subjects.
full_name	str | None	The fully qualified name (e.g., org/repo).
private	bool | None	Whether the repository is private.
html_url	str | None	URL to the repository on GitHub.
description	str | None	The repository description.
created_at	str | None	When the repository was created.
updated_at	str | None	When the repository was last updated.
pushed_at	str | None	When the repository last had a push.
archived	bool | None	Whether the repository is archived.
disabled	bool | None	Whether the repository is disabled.
visibility	str | None	The visibility level: public, private, or internal.
default_branch	str | None	The name of the default branch (e.g., main).
size	int | None	Repository size in kilobytes as reported by GitHub.
open_issues_count	int | None	Number of open issues.
allow_forking	bool | None	Whether forking is allowed.
web_commit_signoff_required	bool | None	Whether web-based commits require sign-off.
forks	int | None	Number of forks.
open_issues	int | None	Number of open issues (includes pull requests).
watchers	int | None	Number of watchers.
owner_name	str | None	The login of the repository owner.
owner_id	str | None	The opaque GraphQL node ID of the repository owner.
owner_database_id	int | None	The numeric GitHub database ID of the repository owner used in immutable OIDC subjects.
environment_name	str | None	The name of the environment (GitHub organization).
actions_enabled	bool | None	Whether GitHub Actions is enabled for this repository.
self_hosted_runners_enabled	bool | None	Whether the repository may use self-hosted runners.
default_workflow_permissions	str | None	The repository’s applicable default GITHUB_TOKEN workflow permissions.
can_approve_pull_request_reviews	bool | None	Whether workflows may approve pull request reviews.
secret_scanning	str | None	Status of secret scanning (e.g., enabled, disabled).
branch_ruleset_count	int | None	Number of branch-targeted rulesets that apply to this repository.
has_branch_rulesets	bool | None	Whether at least one branch-targeted ruleset applies to this repository.
branch_count	int | None	Number of branch refs reported by GitHub for this repository.
environment_count	int | None	Number of deployment environments reported by GitHub for this repository.
deploy_key_count	int | None	Number of deploy keys reported by GitHub for this repository.
query_branches	str | None	Query for branches.
query_protected_branches	str | None	Query for protected branches.
query_branch_protection_rules	str | None	Query for branch protection rules.
query_roles	str | None	Query for roles.
query_teams	str | None	Query for teams.
query_workflows	str | None	Query for workflows.
query_runners	str | None	Query for runners.
query_environments	str | None	Query for environments.
query_secrets	str | None	Query for secrets.
query_variables	str | None	Query for variables.
query_deploy_keys	str | None	Query for deploy keys.
query_secret_scanning_alerts	str | None	Query for secret scanning alerts.
query_explicit_readers	str | None	Query for explicit readers.
query_unrolled_readers	str | None	Query for unrolled readers.
query_explicit_writers	str | None	Query for explicit writers.
query_unrolled_writers	str | None	Query for unrolled writers.