> ## Documentation Index
> Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Schema

> GitHub extension definition schema

<img noZoom src="https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-AND-community-edition-pill-tag.svg?fit=max&auto=format&n=tTIczgde9H07oLXf&q=85&s=ad49a576589f4d2a8081df77d07fdf56" alt="Applies to BloodHound Enterprise and CE" width="482" height="45" data-path="assets/enterprise-AND-community-edition-pill-tag.svg" />

## Metadata

**Name:** SOGitHub<br />
**Display Name:** GitHub Extension (by SpecterOps)<br />
**Version:** v1.2.3<br />
**Namespace:** GH<br />
**Environment Kind:** GH\_Organization<br />
**Source Kind:** GitHub

<Info>
  This file is automatically generated from the [extension definition schema file](https://github.com/SpecterOps/openhound-github/blob/main/extension/schema.json).
</Info>

## Nodes

| Icon                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Node Kind                                                                                          | Display Name                         |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | ------------------------------------ |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_app.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=1e0699969eb5c4f3c2444a96521b66fa" alt="GH_App" width="32" height="32" data-path="images/extensions/github/gh_app.png" />                                                                                                                                                                                                                | [GH\_App](/opengraph/extensions/github/nodes/gh_app)                                               | GitHub App                           |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_appinstallation.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=26bafb311468b11ff72ba661d302a3b4" alt="GH_AppInstallation" width="32" height="32" data-path="images/extensions/github/gh_appinstallation.png" />                                                                                                    | [GH\_AppInstallation](/opengraph/extensions/github/nodes/gh_appinstallation)                       | GitHub App Installation              |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_branch.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=1343761d71331c5a43916a765df2b3f9" alt="GH_Branch" width="32" height="32" data-path="images/extensions/github/gh_branch.png" />                                                                                                                                                                                     | [GH\_Branch](/opengraph/extensions/github/nodes/gh_branch)                                         | GitHub Branch                        |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_branchprotectionrule.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=9ab703edf727df687da99352286fcdc4" alt="GH_BranchProtectionRule" width="32" height="32" data-path="images/extensions/github/gh_branchprotectionrule.png" />                                                       | [GH\_BranchProtectionRule](/opengraph/extensions/github/nodes/gh_branchprotectionrule)             | GitHub Branch Protection Rule        |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_environment.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=5450eea50861638369b067d1abc3ce29" alt="GH_Environment" width="32" height="32" data-path="images/extensions/github/gh_environment.png" />                                                                                                                                        | [GH\_Environment](/opengraph/extensions/github/nodes/gh_environment)                               | GitHub Environment                   |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_environmentsecret.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=a33f6124b428046aeee760806c395e0c" alt="GH_EnvironmentSecret" width="32" height="32" data-path="images/extensions/github/gh_environmentsecret.png" />                                                                                  | [GH\_EnvironmentSecret](/opengraph/extensions/github/nodes/gh_environmentsecret)                   | GitHub Environment Secret            |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_environmentvariable.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=38a82357447784f86b261559f403a31f" alt="GH_EnvironmentVariable" width="32" height="32" data-path="images/extensions/github/gh_environmentvariable.png" />                                                                | [GH\_EnvironmentVariable](/opengraph/extensions/github/nodes/gh_environmentvariable)               | GitHub Environment Variable          |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_externalidentity.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=14aa843c0afd7156de38554d649a21c8" alt="GH_ExternalIdentity" width="32" height="32" data-path="images/extensions/github/gh_externalidentity.png" />                                                                                           | [GH\_ExternalIdentity](/opengraph/extensions/github/nodes/gh_externalidentity)                     | GitHub External Identity             |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_organization.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=eb8a8250eea6f29e06da22c3d11f00ff" alt="GH_Organization" width="32" height="32" data-path="images/extensions/github/gh_organization.png" />                                                                                                                               | [GH\_Organization](/opengraph/extensions/github/nodes/gh_organization)                             | GitHub Organization                  |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_orgrole.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=61860f8e26b5b8b6aafea971b8d77215" alt="GH_OrgRole" width="32" height="32" data-path="images/extensions/github/gh_orgrole.png" />                                                                                                                                                                            | [GH\_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole)                                       | GitHub Org Role                      |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_orgsecret.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=76299bdbd152c75bb8478132cc6aca92" alt="GH_OrgSecret" width="32" height="32" data-path="images/extensions/github/gh_orgsecret.png" />                                                                                                                                                          | [GH\_OrgSecret](/opengraph/extensions/github/nodes/gh_orgsecret)                                   | GitHub Org Secret                    |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_orgvariable.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=17ed2cf9010d5d73d256995c373ba8a5" alt="GH_OrgVariable" width="32" height="32" data-path="images/extensions/github/gh_orgvariable.png" />                                                                                                                                        | [GH\_OrgVariable](/opengraph/extensions/github/nodes/gh_orgvariable)                               | GitHub Org Variable                  |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_personalaccesstoken.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=ef777590dd4220466c1898eaf6108494" alt="GH_PersonalAccessToken" width="32" height="32" data-path="images/extensions/github/gh_personalaccesstoken.png" />                                                                | [GH\_PersonalAccessToken](/opengraph/extensions/github/nodes/gh_personalaccesstoken)               | GitHub Personal Access Token         |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_personalaccesstokenrequest.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=e459b2b904da70a4043759c20962bb5d" alt="GH_PersonalAccessTokenRequest" width="32" height="32" data-path="images/extensions/github/gh_personalaccesstokenrequest.png" /> | [GH\_PersonalAccessTokenRequest](/opengraph/extensions/github/nodes/gh_personalaccesstokenrequest) | GitHub Personal Access Token Request |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_reporole.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=2c737bc6f3c49608ba55ca9fa6904a59" alt="GH_RepoRole" width="32" height="32" data-path="images/extensions/github/gh_reporole.png" />                                                                                                                                                                   | [GH\_RepoRole](/opengraph/extensions/github/nodes/gh_reporole)                                     | GitHub Repo Role                     |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_reposecret.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=9a8e2c7652740650212191ffecd79784" alt="GH_RepoSecret" width="32" height="32" data-path="images/extensions/github/gh_reposecret.png" />                                                                                                                                                 | [GH\_RepoSecret](/opengraph/extensions/github/nodes/gh_reposecret)                                 | GitHub Repo Secret                   |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_repository.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=f96d0cff2bb56a033b852c97d4245798" alt="GH_Repository" width="32" height="32" data-path="images/extensions/github/gh_repository.png" />                                                                                                                                                 | [GH\_Repository](/opengraph/extensions/github/nodes/gh_repository)                                 | GitHub Repository                    |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_repovariable.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=a2225d7eec0015c482caa313ba36ae71" alt="GH_RepoVariable" width="32" height="32" data-path="images/extensions/github/gh_repovariable.png" />                                                                                                                               | [GH\_RepoVariable](/opengraph/extensions/github/nodes/gh_repovariable)                             | GitHub Repo Variable                 |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_samlidentityprovider.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=b122660fb400ad091b1edb61974278d9" alt="GH_SamlIdentityProvider" width="32" height="32" data-path="images/extensions/github/gh_samlidentityprovider.png" />                                                       | [GH\_SamlIdentityProvider](/opengraph/extensions/github/nodes/gh_samlidentityprovider)             | GitHub SAML Identity Provider        |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_secretscanningalert.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=30206ce10c521e634fcf6eccc5d5a186" alt="GH_SecretScanningAlert" width="32" height="32" data-path="images/extensions/github/gh_secretscanningalert.png" />                                                                | [GH\_SecretScanningAlert](/opengraph/extensions/github/nodes/gh_secretscanningalert)               | GitHub Secret Scanning Alert         |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_team.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=3cec0c9d22b60a2f85178bb824e8ee67" alt="GH_Team" width="32" height="32" data-path="images/extensions/github/gh_team.png" />                                                                                                                                                                                                       | [GH\_Team](/opengraph/extensions/github/nodes/gh_team)                                             | GitHub Team                          |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_teamrole.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=ed1b2c60cf4407aa5edcc307df568e57" alt="GH_TeamRole" width="32" height="32" data-path="images/extensions/github/gh_teamrole.png" />                                                                                                                                                                   | [GH\_TeamRole](/opengraph/extensions/github/nodes/gh_teamrole)                                     | GitHub Team Role                     |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_user.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=385d6215c29c08be206ec8a321fddffb" alt="GH_User" width="32" height="32" data-path="images/extensions/github/gh_user.png" />                                                                                                                                                                                                       | [GH\_User](/opengraph/extensions/github/nodes/gh_user)                                             | GitHub User                          |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_workflow.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=023b588af3d31d1c6a3c7a86cee893a3" alt="GH_Workflow" width="32" height="32" data-path="images/extensions/github/gh_workflow.png" />                                                                                                                                                                   | [GH\_Workflow](/opengraph/extensions/github/nodes/gh_workflow)                                     | GitHub Workflow                      |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_workflowjob.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=54003f727e75dd25edc85171709ebe25" alt="GH_WorkflowJob" width="32" height="32" data-path="images/extensions/github/gh_workflowjob.png" />                                                                                                                                        | [GH\_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob)                               | GitHub Workflow Job                  |
| <img src="https://mintcdn.com/specterops/vLZ2lUIRm_HibFmq/images/extensions/github/gh_workflowstep.png?fit=max&auto=format&n=vLZ2lUIRm_HibFmq&q=85&s=1323748c44d5c20e621e25060c9b9a37" alt="GH_WorkflowStep" width="32" height="32" data-path="images/extensions/github/gh_workflowstep.png" />                                                                                                                               | [GH\_WorkflowStep](/opengraph/extensions/github/nodes/gh_workflowstep)                             | GitHub Workflow Step                 |

## Edges

| Relationship Kind                                                                                                                            | Traversable | Description                                                                                                                                                                   |
| -------------------------------------------------------------------------------------------------------------------------------------------- | :---------: | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [GH\_AddAssignee](/opengraph/extensions/github/edges/gh_addassignee)                                                                         |      ❌      | \[Repository] Repo role can assign users to issues and pull requests                                                                                                          |
| [GH\_AddCollaborator](/opengraph/extensions/github/edges/gh_addcollaborator)                                                                 |      ❌      | \[Organization] Org role can add outside collaborators                                                                                                                        |
| [GH\_AddLabel](/opengraph/extensions/github/edges/gh_addlabel)                                                                               |      ❌      | \[Repository] Repo role can add labels to issues and pull requests                                                                                                            |
| [GH\_AddMember](/opengraph/extensions/github/edges/gh_addmember)                                                                             |      ✅      | Team role can add members to the team (maintainer privilege)                                                                                                                  |
| [GH\_AdminTo](/opengraph/extensions/github/edges/gh_adminto)                                                                                 |      ❌      | \[Repository] Repo role has admin access to the repository.                                                                                                                   |
| [GH\_BypassBranchProtection](/opengraph/extensions/github/edges/gh_bypassbranchprotection)                                                   |      ❌      | \[Repository] Repo role can bypass merge-gate branch protections (PR reviews, lock branch). Suppressed by enforce\_admins.                                                    |
| [GH\_BypassPullRequestAllowances](/opengraph/extensions/github/edges/gh_bypasspullrequestallowances)                                         |      ❌      | User or team can bypass pull request requirements on a branch protection rule                                                                                                 |
| [GH\_CallsWorkflow](/opengraph/extensions/github/edges/gh_callsworkflow)                                                                     |      ❌      | \[Workflow] Job calls a reusable workflow — GH\_WorkflowJob → GH\_Workflow                                                                                                    |
| [GH\_CanAccess](/opengraph/extensions/github/edges/gh_canaccess)                                                                             |      ❌      | Personal access token or app installation can access this repository or organization                                                                                          |
| [GH\_CanAssumeIdentity](/opengraph/extensions/github/edges/gh_canassumeidentity)                                                             |      ✅      | Repository can assume this cloud identity via OIDC federation (Azure workload identity or AWS IAM role)                                                                       |
| [GH\_CanCreateBranch](/opengraph/extensions/github/edges/gh_cancreatebranch)                                                                 |      ✅      | \[Repository - Computed] Role can create new branches in this repository (unprotected branches that bypass the merge gate)                                                    |
| [GH\_CanEditProtection](/opengraph/extensions/github/edges/gh_caneditprotection)                                                             |      ✅      | \[Repository - Computed] Repo role can modify or remove branch protection rules for the repository/branch (computed from GH\_EditRepoProtections + GH\_ProtectedBy)           |
| [GH\_CanPwnRequest](/opengraph/extensions/github/edges/gh_canpwnrequest)                                                                     |      ✅      | \[Computed] Repo role can exploit a pwn-requestable workflow to execute arbitrary code with the target's secrets and permissions — GH\_RepoRole → GH\_Repository / GH\_Branch |
| [GH\_CanReadSecretScanningAlert](/opengraph/extensions/github/edges/gh_canreadsecretscanningalert)                                           |      ✅      | \[Computed] Role can read secret scanning alerts (computed from GH\_ViewSecretScanningAlerts permission + GH\_Contains)                                                       |
| [GH\_CanWriteBranch](/opengraph/extensions/github/edges/gh_canwritebranch)                                                                   |      ✅      | \[Repository - Computed] Role can push to this branch after evaluating branch protection rules, push restrictions, and bypass allowances                                      |
| [GH\_CloseDiscussion](/opengraph/extensions/github/edges/gh_closediscussion)                                                                 |      ❌      | \[Repository] Repo role can close discussions                                                                                                                                 |
| [GH\_CloseIssue](/opengraph/extensions/github/edges/gh_closeissue)                                                                           |      ❌      | \[Repository] Repo role can close issues                                                                                                                                      |
| [GH\_ClosePullRequest](/opengraph/extensions/github/edges/gh_closepullrequest)                                                               |      ❌      | \[Repository] Repo role can close pull requests                                                                                                                               |
| [GH\_Contains](/opengraph/extensions/github/edges/gh_contains)                                                                               |      ❌      | Container relationship for organizational hierarchy (org contains secrets/variables, repo contains secrets/variables, environment contains secrets/variables)                 |
| [GH\_ConvertIssuesToDiscussions](/opengraph/extensions/github/edges/gh_convertissuestodiscussions)                                           |      ❌      | \[Repository] Repo role can convert issues to discussions                                                                                                                     |
| [GH\_CreateDiscussionCategory](/opengraph/extensions/github/edges/gh_creatediscussioncategory)                                               |      ❌      | \[Repository] Repo role can create discussion categories                                                                                                                      |
| [GH\_CreateRepository](/opengraph/extensions/github/edges/gh_createrepository)                                                               |      ❌      | \[Organization] Org role can create repositories in the organization                                                                                                          |
| [GH\_CreateSoloMergeQueueEntry](/opengraph/extensions/github/edges/gh_createsolomergequeueentry)                                             |      ❌      | Repo role can create solo merge queue entries                                                                                                                                 |
| [GH\_CreateTag](/opengraph/extensions/github/edges/gh_createtag)                                                                             |      ❌      | \[Repository] Repo role can create tags and releases                                                                                                                          |
| [GH\_CreateTeam](/opengraph/extensions/github/edges/gh_createteam)                                                                           |      ❌      | \[Organization] Org role can create teams in the organization                                                                                                                 |
| [GH\_DeleteAlertsCodeScanning](/opengraph/extensions/github/edges/gh_deletealertscodescanning)                                               |      ❌      | \[Repository] Repo role can delete code scanning alerts                                                                                                                       |
| [GH\_DeleteDiscussion](/opengraph/extensions/github/edges/gh_deletediscussion)                                                               |      ❌      | \[Repository] Repo role can delete discussions                                                                                                                                |
| [GH\_DeleteDiscussionComment](/opengraph/extensions/github/edges/gh_deletediscussioncomment)                                                 |      ❌      | \[Repository] Repo role can delete discussion comments                                                                                                                        |
| [GH\_DeleteIssue](/opengraph/extensions/github/edges/gh_deleteissue)                                                                         |      ❌      | \[Repository] Repo role can delete issues                                                                                                                                     |
| [GH\_DeleteTag](/opengraph/extensions/github/edges/gh_deletetag)                                                                             |      ❌      | \[Repository] Repo role can delete tags and releases                                                                                                                          |
| [GH\_DependsOn](/opengraph/extensions/github/edges/gh_dependson)                                                                             |      ❌      | \[Workflow] Job must run after another job (needs: dependency) — ordering only, not an access path                                                                            |
| [GH\_DeploysTo](/opengraph/extensions/github/edges/gh_deploysto)                                                                             |      ❌      | \[Workflow] Job deploys to a GitHub Environment — GH\_WorkflowJob → GH\_Environment                                                                                           |
| [GH\_EditCategoryOnDiscussion](/opengraph/extensions/github/edges/gh_editcategoryondiscussion)                                               |      ❌      | \[Repository] Repo role can change the category of a discussion                                                                                                               |
| [GH\_EditDiscussionCategory](/opengraph/extensions/github/edges/gh_editdiscussioncategory)                                                   |      ❌      | \[Repository] Repo role can edit discussion categories                                                                                                                        |
| [GH\_EditDiscussionComment](/opengraph/extensions/github/edges/gh_editdiscussioncomment)                                                     |      ❌      | \[Repository] Repo role can edit discussion comments                                                                                                                          |
| [GH\_EditRepoAnnouncementBanners](/opengraph/extensions/github/edges/gh_editrepoannouncementbanners)                                         |      ❌      | \[Repository] Repo role can edit repository announcement banners                                                                                                              |
| [GH\_EditRepoCustomPropertiesValues](/opengraph/extensions/github/edges/gh_editrepocustompropertiesvalues)                                   |      ❌      | \[Repository] Repo role can edit custom property values on the repository                                                                                                     |
| [GH\_EditRepoMetadata](/opengraph/extensions/github/edges/gh_editrepometadata)                                                               |      ❌      | \[Repository] Repo role can edit repository metadata                                                                                                                          |
| [GH\_EditRepoProtections](/opengraph/extensions/github/edges/gh_editrepoprotections)                                                         |      ❌      | Repo role can edit branch protection rules                                                                                                                                    |
| [GH\_HasBaseRole](/opengraph/extensions/github/edges/gh_hasbaserole)                                                                         |      ✅      | Role inherits permissions from another role                                                                                                                                   |
| [GH\_HasBranch](/opengraph/extensions/github/edges/gh_hasbranch)                                                                             |      ❌      | Repository has this branch                                                                                                                                                    |
| [GH\_HasEnvironment](/opengraph/extensions/github/edges/gh_hasenvironment)                                                                   |      ❌      | Repository or branch has/can deploy to this environment                                                                                                                       |
| [GH\_HasExternalIdentity](/opengraph/extensions/github/edges/gh_hasexternalidentity)                                                         |      ❌      | SAML identity provider has this external identity                                                                                                                             |
| [GH\_HasJob](/opengraph/extensions/github/edges/gh_hasjob)                                                                                   |      ❌      | \[Workflow] Workflow contains this job — GH\_Workflow → GH\_WorkflowJob                                                                                                       |
| [GH\_HasMember](/opengraph/extensions/github/edges/gh_hasmember)                                                                             |      ❌      | Enterprise or organization has this user as a member                                                                                                                          |
| [GH\_HasPersonalAccessToken](/opengraph/extensions/github/edges/gh_haspersonalaccesstoken)                                                   |      ❌      | User owns this personal access token that has been granted access to the organization                                                                                         |
| [GH\_HasPersonalAccessTokenRequest](/opengraph/extensions/github/edges/gh_haspersonalaccesstokenrequest)                                     |      ❌      | User has a pending personal access token request for the organization                                                                                                         |
| [GH\_HasRole](/opengraph/extensions/github/edges/gh_hasrole)                                                                                 |      ✅      | User or team has a role assignment (org role, team role, or repo role)                                                                                                        |
| [GH\_HasSamlIdentityProvider](/opengraph/extensions/github/edges/gh_hassamlidentityprovider)                                                 |      ❌      | Organization has this SAML identity provider configured                                                                                                                       |
| [GH\_HasSecret](/opengraph/extensions/github/edges/gh_hassecret)                                                                             |      ✅      | Repository or environment has access to this secret                                                                                                                           |
| [GH\_HasStep](/opengraph/extensions/github/edges/gh_hasstep)                                                                                 |      ❌      | \[Workflow] Job contains this step — GH\_WorkflowJob → GH\_WorkflowStep                                                                                                       |
| [GH\_HasVariable](/opengraph/extensions/github/edges/gh_hasvariable)                                                                         |      ✅      | Repository has access to this variable (org-level or repo-level)                                                                                                              |
| [GH\_HasWorkflow](/opengraph/extensions/github/edges/gh_hasworkflow)                                                                         |      ❌      | Repository has this workflow                                                                                                                                                  |
| [GH\_InstalledAs](/opengraph/extensions/github/edges/gh_installedas)                                                                         |      ✅      | GitHub App is installed as this app installation on an organization                                                                                                           |
| [GH\_InviteMember](/opengraph/extensions/github/edges/gh_invitemember)                                                                       |      ❌      | \[Organization] Org role can invite members to the organization                                                                                                               |
| [GH\_JumpMergeQueue](/opengraph/extensions/github/edges/gh_jumpmergequeue)                                                                   |      ❌      | Repo role can jump the merge queue                                                                                                                                            |
| [GH\_ManageDeployKeys](/opengraph/extensions/github/edges/gh_managedeploykeys)                                                               |      ❌      | \[Repository] Repo role can manage deploy keys                                                                                                                                |
| [GH\_ManageDiscussionBadges](/opengraph/extensions/github/edges/gh_managediscussionbadges)                                                   |      ❌      | \[Repository] Repo role can manage discussion badges                                                                                                                          |
| [GH\_ManageOrganizationWebhooks](/opengraph/extensions/github/edges/gh_manageorganizationwebhooks)                                           |      ❌      | \[Organization] Org role can manage organization webhooks                                                                                                                     |
| [GH\_ManageRepoSecurityProducts](/opengraph/extensions/github/edges/gh_managereposecurityproducts)                                           |      ❌      | Repo role can manage repo-level security products                                                                                                                             |
| [GH\_ManageSecurityProducts](/opengraph/extensions/github/edges/gh_managesecurityproducts)                                                   |      ❌      | Repo role can manage security products                                                                                                                                        |
| [GH\_ManageSettingsMergeTypes](/opengraph/extensions/github/edges/gh_managesettingsmergetypes)                                               |      ❌      | \[Repository] Repo role can manage allowed merge types                                                                                                                        |
| [GH\_ManageSettingsPages](/opengraph/extensions/github/edges/gh_managesettingspages)                                                         |      ❌      | \[Repository] Repo role can manage GitHub Pages settings                                                                                                                      |
| [GH\_ManageSettingsProjects](/opengraph/extensions/github/edges/gh_managesettingsprojects)                                                   |      ❌      | \[Repository] Repo role can manage project settings                                                                                                                           |
| [GH\_ManageSettingsWiki](/opengraph/extensions/github/edges/gh_managesettingswiki)                                                           |      ❌      | \[Repository] Repo role can manage wiki settings                                                                                                                              |
| [GH\_ManageTopics](/opengraph/extensions/github/edges/gh_managetopics)                                                                       |      ❌      | \[Repository] Repo role can manage repository topics                                                                                                                          |
| [GH\_ManageWebhooks](/opengraph/extensions/github/edges/gh_managewebhooks)                                                                   |      ❌      | \[Repository] Repo role can manage repository webhooks                                                                                                                        |
| [GH\_MapsToUser](/opengraph/extensions/github/edges/gh_mapstouser)                                                                           |      ❌      | External identity maps to a GitHub user or identity provider user                                                                                                             |
| [GH\_MarkAsDuplicate](/opengraph/extensions/github/edges/gh_markasduplicate)                                                                 |      ❌      | \[Repository] Repo role can mark issues or pull requests as duplicates                                                                                                        |
| [GH\_MemberOf](/opengraph/extensions/github/edges/gh_memberof)                                                                               |      ✅      | Team role is a member of a team, or team is a nested member of a parent team                                                                                                  |
| [GH\_OrgBypassCodeScanningDismissalRequests](/opengraph/extensions/github/edges/gh_orgbypasscodescanningdismissalrequests)                   |      ❌      | \[Organization] Org role can bypass code scanning dismissal requests                                                                                                          |
| [GH\_OrgBypassSecretScanningClosureRequests](/opengraph/extensions/github/edges/gh_orgbypasssecretscanningclosurerequests)                   |      ❌      | \[Organization] Org role can bypass secret scanning closure requests                                                                                                          |
| [GH\_OrgReviewAndManageSecretScanningBypassRequests](/opengraph/extensions/github/edges/gh_orgreviewandmanagesecretscanningbypassrequests)   |      ❌      | \[Organization] Org role can review and manage secret scanning bypass requests                                                                                                |
| [GH\_OrgReviewAndManageSecretScanningClosureRequests](/opengraph/extensions/github/edges/gh_orgreviewandmanagesecretscanningclosurerequests) |      ❌      | \[Organization] Org role can review and manage secret scanning closure requests                                                                                               |
| [GH\_Owns](/opengraph/extensions/github/edges/gh_owns)                                                                                       |      ✅      | Organization owns a repository                                                                                                                                                |
| [GH\_ProtectedBy](/opengraph/extensions/github/edges/gh_protectedby)                                                                         |      ❌      | Branch protection rule protects this branch                                                                                                                                   |
| [GH\_PushProtectedBranch](/opengraph/extensions/github/edges/gh_pushprotectedbranch)                                                         |      ❌      | \[Repository] Repo role can push to branches with push restrictions. Not affected by enforce\_admins.                                                                         |
| [GH\_ReadCodeScanning](/opengraph/extensions/github/edges/gh_readcodescanning)                                                               |      ❌      | \[Repository] Repo role can read code scanning results                                                                                                                        |
| [GH\_ReadOrganizationActionsUsageMetrics](/opengraph/extensions/github/edges/gh_readorganizationactionsusagemetrics)                         |      ❌      | \[Organization] Org role can read Actions usage metrics                                                                                                                       |
| [GH\_ReadOrganizationCustomOrgRole](/opengraph/extensions/github/edges/gh_readorganizationcustomorgrole)                                     |      ❌      | \[Organization] Org role can read custom org role definitions                                                                                                                 |
| [GH\_ReadOrganizationCustomRepoRole](/opengraph/extensions/github/edges/gh_readorganizationcustomreporole)                                   |      ❌      | \[Organization] Org role can read custom repo role definitions                                                                                                                |
| [GH\_ReadRepoContents](/opengraph/extensions/github/edges/gh_readrepocontents)                                                               |      ❌      | \[Repository] Repo role can read repository contents                                                                                                                          |
| [GH\_RemoveAssignee](/opengraph/extensions/github/edges/gh_removeassignee)                                                                   |      ❌      | \[Repository] Repo role can remove assignees from issues and pull requests                                                                                                    |
| [GH\_RemoveLabel](/opengraph/extensions/github/edges/gh_removelabel)                                                                         |      ❌      | \[Repository] Repo role can remove labels from issues and pull requests                                                                                                       |
| [GH\_ReopenDiscussion](/opengraph/extensions/github/edges/gh_reopendiscussion)                                                               |      ❌      | \[Repository] Repo role can reopen discussions                                                                                                                                |
| [GH\_ReopenIssue](/opengraph/extensions/github/edges/gh_reopenissue)                                                                         |      ❌      | \[Repository] Repo role can reopen closed issues                                                                                                                              |
| [GH\_ReopenPullRequest](/opengraph/extensions/github/edges/gh_reopenpullrequest)                                                             |      ❌      | \[Repository] Repo role can reopen closed pull requests                                                                                                                       |
| [GH\_RequestPrReview](/opengraph/extensions/github/edges/gh_requestprreview)                                                                 |      ❌      | \[Repository] Repo role can request pull request reviews                                                                                                                      |
| [GH\_ResolveDependabotAlerts](/opengraph/extensions/github/edges/gh_resolvedependabotalerts)                                                 |      ❌      | \[Repository] Repo role can resolve Dependabot alerts                                                                                                                         |
| [GH\_ResolveSecretScanningAlerts](/opengraph/extensions/github/edges/gh_resolvesecretscanningalerts)                                         |      ❌      | \[Organization] Org role can resolve secret scanning alerts                                                                                                                   |
| [GH\_RestrictionsCanPush](/opengraph/extensions/github/edges/gh_restrictionscanpush)                                                         |      ❌      | User or team is allowed to push to branches protected by this rule                                                                                                            |
| [GH\_RunOrgMigration](/opengraph/extensions/github/edges/gh_runorgmigration)                                                                 |      ❌      | \[Repository] Repo role can run organization migrations                                                                                                                       |
| [GH\_SetInteractionLimits](/opengraph/extensions/github/edges/gh_setinteractionlimits)                                                       |      ❌      | \[Repository] Repo role can set interaction limits on the repository                                                                                                          |
| [GH\_SetIssueType](/opengraph/extensions/github/edges/gh_setissuetype)                                                                       |      ❌      | \[Repository] Repo role can set issue types                                                                                                                                   |
| [GH\_SetMilestone](/opengraph/extensions/github/edges/gh_setmilestone)                                                                       |      ❌      | \[Repository] Repo role can set milestones on issues and pull requests                                                                                                        |
| [GH\_SetSocialPreview](/opengraph/extensions/github/edges/gh_setsocialpreview)                                                               |      ❌      | \[Repository] Repo role can set the repository social preview image                                                                                                           |
| [GH\_SyncedTo](/opengraph/extensions/github/edges/gh_syncedto)                                                                               |      ✅      | External identity (Azure, Okta, PingOne) is synced to this GitHub user via SSO/SCIM                                                                                           |
| [GH\_ToggleDiscussionAnswer](/opengraph/extensions/github/edges/gh_togglediscussionanswer)                                                   |      ❌      | \[Repository] Repo role can toggle discussion answers                                                                                                                         |
| [GH\_ToggleDiscussionCommentMinimize](/opengraph/extensions/github/edges/gh_togglediscussioncommentminimize)                                 |      ❌      | \[Repository] Repo role can minimize discussion comments                                                                                                                      |
| [GH\_TransferRepository](/opengraph/extensions/github/edges/gh_transferrepository)                                                           |      ❌      | \[Organization] Org role can transfer repositories                                                                                                                            |
| [GH\_UsesSecret](/opengraph/extensions/github/edges/gh_usessecret)                                                                           |      ❌      | \[Workflow] Step references a secret by name — GH\_WorkflowStep → GH\_RepoSecret / GH\_OrgSecret (name match)                                                                 |
| [GH\_UsesVariable](/opengraph/extensions/github/edges/gh_usesvariable)                                                                       |      ❌      | \[Workflow] Step references a variable by name — GH\_WorkflowStep → GH\_RepoVariable / GH\_OrgVariable (name match)                                                           |
| [GH\_ValidToken](/opengraph/extensions/github/edges/gh_validtoken)                                                                           |      ✅      | Secret scanning alert contains a valid, active token belonging to this user                                                                                                   |
| [GH\_ViewDependabotAlerts](/opengraph/extensions/github/edges/gh_viewdependabotalerts)                                                       |      ❌      | \[Repository] Repo role can view Dependabot alerts                                                                                                                            |
| [GH\_ViewSecretScanningAlerts](/opengraph/extensions/github/edges/gh_viewsecretscanningalerts)                                               |      ❌      | \[Repository] Role can view secret scanning alerts                                                                                                                            |
| [GH\_WriteCodeScanning](/opengraph/extensions/github/edges/gh_writecodescanning)                                                             |      ❌      | \[Repository] Repo role can upload code scanning results                                                                                                                      |
| [GH\_WriteOrganizationActionsSecrets](/opengraph/extensions/github/edges/gh_writeorganizationactionssecrets)                                 |      ❌      | \[Organization] Org role can write Actions secrets                                                                                                                            |
| [GH\_WriteOrganizationActionsSettings](/opengraph/extensions/github/edges/gh_writeorganizationactionssettings)                               |      ❌      | \[Organization] Org role can write Actions settings                                                                                                                           |
| [GH\_WriteOrganizationActionsVariables](/opengraph/extensions/github/edges/gh_writeorganizationactionsvariables)                             |      ❌      | \[Organization] Org role can write Actions variables                                                                                                                          |
| [GH\_WriteOrganizationCustomOrgRole](/opengraph/extensions/github/edges/gh_writeorganizationcustomorgrole)                                   |      ✅      | \[Organization] Org role can write custom org role definitions                                                                                                                |
| [GH\_WriteOrganizationCustomRepoRole](/opengraph/extensions/github/edges/gh_writeorganizationcustomreporole)                                 |      ❌      | \[Organization] Org role can write custom repo role definitions                                                                                                               |
| [GH\_WriteOrganizationNetworkConfigurations](/opengraph/extensions/github/edges/gh_writeorganizationnetworkconfigurations)                   |      ❌      | \[Organization] Org role can write network configurations                                                                                                                     |
| [GH\_WriteRepoContents](/opengraph/extensions/github/edges/gh_writerepocontents)                                                             |      ❌      | \[Repository] Repo role can write repository contents                                                                                                                         |
| [GH\_WriteRepoPullRequests](/opengraph/extensions/github/edges/gh_writerepopullrequests)                                                     |      ❌      | \[Repository] Repo role can create and merge pull requests                                                                                                                    |
