{
  "schema": "aaes/capability-pack/1",
  "provider": "github",
  "version": "1.0.0",
  "description": "List GitHub repositories, create issues, merge pull requests, delete repositories, and transfer repositories to another owner.",
  "notes": "ORG, OWNER, REPO and NUMBER in the endpoint paths are placeholders: replace them with the organization and repository this capability is bound to before enabling. The egress allowlist stays api.github.com.",
  "credential": {
    "secret_ref_id": "secret-ref-github-app-token",
    "custody": "customer_vault",
    "inject": "header",
    "inject_name": "Authorization",
    "note": "A GitHub App installation token (preferred: short-lived and repository-scoped) or a fine-grained personal access token, held in the client's own secret manager. The stored material must be the complete Authorization header value (scheme included). Installation tokens expire, so the reference must be refreshed by the deployment's custody job; an expired reference fails closed."
  },
  "capabilities": [
    {
      "capability_id": "github.repos.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "api.github.com"
      ],
      "endpoint": "https://api.github.com/orgs/ORG/repos",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-github-app-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "github-org",
      "description": "List the organization's repositories.",
      "requires_review": true
    },
    {
      "capability_id": "github.issue.create",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R2",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "api.github.com"
      ],
      "endpoint": "https://api.github.com/repos/OWNER/REPO/issues",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-github-app-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "create"
      ],
      "resource_id": "github-org",
      "description": "Open an issue in one repository.",
      "requires_review": true
    },
    {
      "capability_id": "github.pull_request.merge",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "api.github.com"
      ],
      "endpoint": "https://api.github.com/repos/OWNER/REPO/pulls/NUMBER/merge",
      "method": "PUT",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-github-app-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "deploy"
      ],
      "resource_id": "github-org",
      "description": "Merge a pull request, which publishes a change to a live branch; registered with the deploy action at the minimum R3 tier rather than as an ordinary update, because deploy is one of the designated actions requiring human approval.",
      "requires_review": true
    },
    {
      "capability_id": "github.repo.delete",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "api.github.com"
      ],
      "endpoint": "https://api.github.com/repos/OWNER/REPO",
      "method": "DELETE",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-github-app-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "delete"
      ],
      "resource_id": "github-org",
      "description": "Delete a repository. Delete is one of the designated actions requiring human approval; policy can raise the tier above the minimum R3 tier.",
      "requires_review": true
    },
    {
      "capability_id": "github.repo.transfer",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "api.github.com"
      ],
      "endpoint": "https://api.github.com/repos/OWNER/REPO/transfer",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-github-app-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "transfer"
      ],
      "resource_id": "github-org",
      "description": "Transfer a repository to another owner. Ownership leaving the organisation cannot be reliably undone, and transfer is one of the designated actions requiring human approval, which is why it carries the minimum R3 tier.",
      "requires_review": true
    }
  ],
  "resources": [
    {
      "resource_id": "github-org",
      "kind": "api",
      "locator": "https://api.github.com/orgs/ORG",
      "data_class": "internal",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    }
  ],
  "review": {
    "state": "library",
    "date": "2026-09-23",
    "sources": [
      "https://docs.github.com/en/rest/repos/repos (retrieved 2026-09-20)",
      "https://docs.github.com/en/rest/issues/issues (retrieved 2026-09-20)",
      "https://docs.github.com/en/rest/pulls/pulls (retrieved 2026-09-20)",
      "https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app (retrieved 2026-09-23)"
    ],
    "reviewer_id": "aaes-eng"
  }
}