schema.json

{
  "schema": {
    "name": "SOGitHub",
    "display_name": "GitHub Extension (by SpecterOps)",
    "version": "v1.3.0",
    "namespace": "GH"
  },
  "node_kinds": [
    {
      "name": "GH_Enterprise",
      "display_name": "GitHub Enterprise",
      "description": "A GitHub Enterprise account that contains member organizations and enterprise-wide settings",
      "is_display_kind": true,
      "icon": "globe",
      "color": "#4A90D9"
    },
    {
      "name": "GH_Organization",
      "display_name": "GitHub Organization",
      "description": "A GitHub Organization—top-level container for repositories, teams, and settings",
      "is_display_kind": true,
      "icon": "building-flag",
      "color": "#5FED83"
    },
    {
      "name": "GH_User",
      "display_name": "GitHub User",
      "description": "An individual GitHub user account",
      "is_display_kind": true,
      "icon": "user",
      "color": "#FF8E40"
    },
    {
      "name": "GH_EnterpriseTeam",
      "display_name": "GitHub Enterprise Team",
      "description": "An enterprise-level team that can be assigned into one or more organizations and projected as organization teams",
      "is_display_kind": true,
      "icon": "users-between-lines",
      "color": "#7C3AED"
    },
    {
      "name": "GH_Team",
      "display_name": "GitHub Team",
      "description": "A team within an organization, grouping users for shared access and collaboration",
      "is_display_kind": true,
      "icon": "user-group",
      "color": "#C06EFF"
    },
    {
      "name": "GH_Repository",
      "display_name": "GitHub Repository",
      "description": "A code repository in an organization, containing files, issues, and other resources",
      "is_display_kind": true,
      "icon": "book",
      "color": "#9EECFF"
    },
    {
      "name": "GH_RunnerGroup",
      "display_name": "GitHub Runner Group",
      "description": "An organization-level self-hosted runner group that controls which repositories may use a set of runners",
      "is_display_kind": true,
      "icon": "users-rectangle",
      "color": "#B4F8C8"
    },
    {
      "name": "GH_Runner",
      "display_name": "GitHub Self-Hosted Runner",
      "description": "A generic self-hosted runner kind shared by organization-scoped and repository-scoped runner nodes",
      "is_display_kind": false,
      "icon": "server",
      "color": "#FFD580"
    },
    {
      "name": "GH_OrgRunner",
      "display_name": "GitHub Org Self-Hosted Runner",
      "description": "A self-hosted runner registered at the organization scope for GitHub Actions jobs",
      "is_display_kind": true,
      "icon": "server",
      "color": "#FFD580"
    },
    {
      "name": "GH_RepoRunner",
      "display_name": "GitHub Repo Self-Hosted Runner",
      "description": "A self-hosted runner registered directly to a repository for GitHub Actions jobs",
      "is_display_kind": true,
      "icon": "server",
      "color": "#FFD580"
    },
    {
      "name": "GH_Branch",
      "display_name": "GitHub Branch",
      "description": "A named reference in a repository representing a line of development",
      "is_display_kind": true,
      "icon": "code-branch",
      "color": "#FF80D2"
    },
    {
      "name": "GH_BranchProtectionRule",
      "display_name": "GitHub Branch Protection Rule",
      "description": "A branch protection rule that applies to one or more branches via pattern matching",
      "is_display_kind": true,
      "icon": "shield",
      "color": "#FFB347"
    },
    {
      "name": "GH_OrgRole",
      "display_name": "GitHub Org Role",
      "description": "The role a user has at the organization level (e.g., admin, member)",
      "is_display_kind": true,
      "icon": "user-tie",
      "color": "#BFFFD1"
    },
    {
      "name": "GH_TeamRole",
      "display_name": "GitHub Team Role",
      "description": "The role a user has within a team (e.g., maintainer, member)",
      "is_display_kind": true,
      "icon": "user-tie",
      "color": "#D0B0FF"
    },
    {
      "name": "GH_RepoRole",
      "display_name": "GitHub Repo Role",
      "description": "The permission granted to a user or team on a repository (e.g., admin, write, read)",
      "is_display_kind": true,
      "icon": "user-tie",
      "color": "#DEFEFA"
    },
    {
      "name": "GH_Workflow",
      "display_name": "GitHub Workflow",
      "description": "A GitHub Actions workflow defined in a repository",
      "is_display_kind": true,
      "icon": "gears",
      "color": "#FFE4A1"
    },
    {
      "name": "GH_WorkflowJob",
      "display_name": "GitHub Workflow Job",
      "description": "A job within a GitHub Actions workflow, with a runner, permissions, and an ordered list of steps",
      "is_display_kind": true,
      "icon": "layer-group",
      "color": "#6EE7B7"
    },
    {
      "name": "GH_WorkflowStep",
      "display_name": "GitHub Workflow Step",
      "description": "A single step within a GitHub Actions job — either a uses: action reference or a run: shell command",
      "is_display_kind": true,
      "icon": "circle-dot",
      "color": "#C7D2FE"
    },
    {
      "name": "GH_Environment",
      "display_name": "GitHub Environment",
      "description": "A GitHub Actions deployment environment with protection rules and deployment branch policies",
      "is_display_kind": true,
      "icon": "leaf",
      "color": "#D5F2C2"
    },
    {
      "name": "GH_OrgSecret",
      "display_name": "GitHub Org Secret",
      "description": "An organization-level GitHub Actions secret that can be scoped to all, private, or selected repositories",
      "is_display_kind": true,
      "icon": "lock",
      "color": "#1FB65A"
    },
    {
      "name": "GH_RepoSecret",
      "display_name": "GitHub Repo Secret",
      "description": "A repository-level GitHub Actions secret accessible only to workflows in that repository",
      "is_display_kind": true,
      "icon": "lock",
      "color": "#32BEE6"
    },
    {
      "name": "GH_EnvironmentSecret",
      "display_name": "GitHub Environment Secret",
      "description": "An environment-level GitHub Actions secret scoped to a specific deployment environment",
      "is_display_kind": true,
      "icon": "lock",
      "color": "#6FB94A"
    },
    {
      "name": "GH_OrgVariable",
      "display_name": "GitHub Org Variable",
      "description": "An organization-level GitHub Actions variable that can be scoped to all, private, or selected repositories. Unlike secrets, variable values are readable.",
      "is_display_kind": true,
      "icon": "lock-open",
      "color": "#E8B84D"
    },
    {
      "name": "GH_RepoVariable",
      "display_name": "GitHub Repo Variable",
      "description": "A repository-level GitHub Actions variable accessible only to workflows in that repository. Unlike secrets, variable values are readable.",
      "is_display_kind": true,
      "icon": "lock-open",
      "color": "#E89B5C"
    },
    {
      "name": "GH_EnvironmentVariable",
      "display_name": "GitHub Environment Variable",
      "description": "An environment-level GitHub Actions variable scoped to a specific deployment environment. Unlike secrets, variable values are readable.",
      "is_display_kind": true,
      "icon": "lock-open",
      "color": "#D4A84B"
    },
    {
      "name": "GH_SecretScanningAlert",
      "display_name": "GitHub Secret Scanning Alert",
      "description": "A GitHub Advanced Security alert indicating a secret was accidentally committed to a repository",
      "is_display_kind": true,
      "icon": "key",
      "color": "#3C7A6E"
    },
    {
      "name": "GH_SamlIdentityProvider",
      "display_name": "GitHub SAML Identity Provider",
      "description": "A SAML identity provider configured for the organization, enabling SSO",
      "is_display_kind": true,
      "icon": "id-badge",
      "color": "#5A6C8F"
    },
    {
      "name": "GH_ExternalIdentity",
      "display_name": "GitHub External Identity",
      "description": "An external identity from a SAML/SCIM provider linked to a GitHub user for SSO authentication",
      "is_display_kind": true,
      "icon": "arrows-left-right",
      "color": "#8A8F98"
    },
    {
      "name": "GH_App",
      "display_name": "GitHub App",
      "description": "A GitHub App definition representing the registered application. The app owner controls the private key used to generate installation tokens.",
      "is_display_kind": true,
      "icon": "cube",
      "color": "#7EC8E3"
    },
    {
      "name": "GH_AppInstallation",
      "display_name": "GitHub App Installation",
      "description": "A GitHub App installed on the organization with specific permissions and repository access",
      "is_display_kind": true,
      "icon": "plug",
      "color": "#A8D8EA"
    },
    {
      "name": "GH_PersonalAccessToken",
      "display_name": "GitHub Personal Access Token",
      "description": "A fine-grained personal access token granted access to organization resources",
      "is_display_kind": true,
      "icon": "key",
      "color": "#F5A623"
    },
    {
      "name": "GH_PersonalAccessTokenRequest",
      "display_name": "GitHub Personal Access Token Request",
      "description": "A pending request from an organization member to access organization resources with a fine-grained personal access token",
      "is_display_kind": true,
      "icon": "key",
      "color": "#D4A017"
    }
  ],
  "relationship_kinds": [
    {
      "name": "GH_Contains",
      "description": "Container relationship for organizational hierarchy (org contains secrets/variables, repo contains secrets/variables, environment contains secrets/variables)",
      "is_traversable": false
    },
    {
      "name": "GH_AssignedTo",
      "description": "Structural assignment relationship showing that an enterprise team is assigned to an organization",
      "is_traversable": false
    },
    {
      "name": "GH_Owns",
      "description": "Organization owns a repository",
      "is_traversable": true
    },
    {
      "name": "GH_HasRole",
      "description": "User or team has a role assignment (org role, team role, or repo role)",
      "is_traversable": true
    },
    {
      "name": "GH_MemberOf",
      "description": "Team role is a member of a team, or team is a nested member of a parent team",
      "is_traversable": true
    },
    {
      "name": "GH_AddMember",
      "description": "Team role can add members to the team (maintainer privilege)",
      "is_traversable": true
    },
    {
      "name": "GH_HasBaseRole",
      "description": "Role inherits permissions from another role",
      "is_traversable": true
    },
    {
      "name": "GH_ReadRepoContents",
      "description": "[Repository] Repo role can read repository contents",
      "is_traversable": false
    },
    {
      "name": "GH_WriteRepoContents",
      "description": "[Repository] Repo role can write repository contents",
      "is_traversable": false
    },
    {
      "name": "GH_WriteRepoPullRequests",
      "description": "[Repository] Repo role can create and merge pull requests",
      "is_traversable": false
    },
    {
      "name": "GH_AdminTo",
      "description": "[Repository] Repo role has admin access to the repository.",
      "is_traversable": false
    },
    {
      "name": "GH_BypassBranchProtection",
      "description": "[Repository] Repo role can bypass merge-gate branch protections (PR reviews, lock branch). Suppressed by enforce_admins.",
      "is_traversable": false
    },
    {
      "name": "GH_PushProtectedBranch",
      "description": "[Repository] Repo role can push to branches with push restrictions. Not affected by enforce_admins.",
      "is_traversable": false
    },
    {
      "name": "GH_ManageWebhooks",
      "description": "[Repository] Repo role can manage repository webhooks",
      "is_traversable": false
    },
    {
      "name": "GH_ManageDeployKeys",
      "description": "[Repository] Repo role can manage deploy keys",
      "is_traversable": false
    },
    {
      "name": "GH_DeleteAlertsCodeScanning",
      "description": "[Repository] Repo role can delete code scanning alerts",
      "is_traversable": false
    },
    {
      "name": "GH_ViewSecretScanningAlerts",
      "description": "[Repository] Role can view secret scanning alerts",
      "is_traversable": false
    },
    {
      "name": "GH_RunOrgMigration",
      "description": "[Repository] Repo role can run organization migrations",
      "is_traversable": false
    },
    {
      "name": "GH_ManageSecurityProducts",
      "description": "Repo role can manage security products",
      "is_traversable": false
    },
    {
      "name": "GH_ManageRepoSecurityProducts",
      "description": "Repo role can manage repo-level security products",
      "is_traversable": false
    },
    {
      "name": "GH_EditRepoProtections",
      "description": "Repo role can edit branch protection rules",
      "is_traversable": false
    },
    {
      "name": "GH_JumpMergeQueue",
      "description": "Repo role can jump the merge queue",
      "is_traversable": false
    },
    {
      "name": "GH_CreateSoloMergeQueueEntry",
      "description": "Repo role can create solo merge queue entries",
      "is_traversable": false
    },
    {
      "name": "GH_EditRepoCustomPropertiesValues",
      "description": "[Repository] Repo role can edit custom property values on the repository",
      "is_traversable": false
    },
    {
      "name": "GH_AddLabel",
      "description": "[Repository] Repo role can add labels to issues and pull requests",
      "is_traversable": false
    },
    {
      "name": "GH_RemoveLabel",
      "description": "[Repository] Repo role can remove labels from issues and pull requests",
      "is_traversable": false
    },
    {
      "name": "GH_CloseIssue",
      "description": "[Repository] Repo role can close issues",
      "is_traversable": false
    },
    {
      "name": "GH_ReopenIssue",
      "description": "[Repository] Repo role can reopen closed issues",
      "is_traversable": false
    },
    {
      "name": "GH_ClosePullRequest",
      "description": "[Repository] Repo role can close pull requests",
      "is_traversable": false
    },
    {
      "name": "GH_ReopenPullRequest",
      "description": "[Repository] Repo role can reopen closed pull requests",
      "is_traversable": false
    },
    {
      "name": "GH_AddAssignee",
      "description": "[Repository] Repo role can assign users to issues and pull requests",
      "is_traversable": false
    },
    {
      "name": "GH_DeleteIssue",
      "description": "[Repository] Repo role can delete issues",
      "is_traversable": false
    },
    {
      "name": "GH_RemoveAssignee",
      "description": "[Repository] Repo role can remove assignees from issues and pull requests",
      "is_traversable": false
    },
    {
      "name": "GH_RequestPrReview",
      "description": "[Repository] Repo role can request pull request reviews",
      "is_traversable": false
    },
    {
      "name": "GH_MarkAsDuplicate",
      "description": "[Repository] Repo role can mark issues or pull requests as duplicates",
      "is_traversable": false
    },
    {
      "name": "GH_SetMilestone",
      "description": "[Repository] Repo role can set milestones on issues and pull requests",
      "is_traversable": false
    },
    {
      "name": "GH_SetIssueType",
      "description": "[Repository] Repo role can set issue types",
      "is_traversable": false
    },
    {
      "name": "GH_ManageTopics",
      "description": "[Repository] Repo role can manage repository topics",
      "is_traversable": false
    },
    {
      "name": "GH_ManageSettingsWiki",
      "description": "[Repository] Repo role can manage wiki settings",
      "is_traversable": false
    },
    {
      "name": "GH_ManageSettingsProjects",
      "description": "[Repository] Repo role can manage project settings",
      "is_traversable": false
    },
    {
      "name": "GH_ManageSettingsMergeTypes",
      "description": "[Repository] Repo role can manage allowed merge types",
      "is_traversable": false
    },
    {
      "name": "GH_ManageSettingsPages",
      "description": "[Repository] Repo role can manage GitHub Pages settings",
      "is_traversable": false
    },
    {
      "name": "GH_EditRepoMetadata",
      "description": "[Repository] Repo role can edit repository metadata",
      "is_traversable": false
    },
    {
      "name": "GH_SetInteractionLimits",
      "description": "[Repository] Repo role can set interaction limits on the repository",
      "is_traversable": false
    },
    {
      "name": "GH_SetSocialPreview",
      "description": "[Repository] Repo role can set the repository social preview image",
      "is_traversable": false
    },
    {
      "name": "GH_EditRepoAnnouncementBanners",
      "description": "[Repository] Repo role can edit repository announcement banners",
      "is_traversable": false
    },
    {
      "name": "GH_ReadCodeScanning",
      "description": "[Repository] Repo role can read code scanning results",
      "is_traversable": false
    },
    {
      "name": "GH_WriteCodeScanning",
      "description": "[Repository] Repo role can upload code scanning results",
      "is_traversable": false
    },
    {
      "name": "GH_ViewDependabotAlerts",
      "description": "[Repository] Repo role can view Dependabot alerts",
      "is_traversable": false
    },
    {
      "name": "GH_ResolveDependabotAlerts",
      "description": "[Repository] Repo role can resolve Dependabot alerts",
      "is_traversable": false
    },
    {
      "name": "GH_DeleteDiscussion",
      "description": "[Repository] Repo role can delete discussions",
      "is_traversable": false
    },
    {
      "name": "GH_ToggleDiscussionAnswer",
      "description": "[Repository] Repo role can toggle discussion answers",
      "is_traversable": false
    },
    {
      "name": "GH_ToggleDiscussionCommentMinimize",
      "description": "[Repository] Repo role can minimize discussion comments",
      "is_traversable": false
    },
    {
      "name": "GH_EditDiscussionCategory",
      "description": "[Repository] Repo role can edit discussion categories",
      "is_traversable": false
    },
    {
      "name": "GH_CreateDiscussionCategory",
      "description": "[Repository] Repo role can create discussion categories",
      "is_traversable": false
    },
    {
      "name": "GH_ConvertIssuesToDiscussions",
      "description": "[Repository] Repo role can convert issues to discussions",
      "is_traversable": false
    },
    {
      "name": "GH_CloseDiscussion",
      "description": "[Repository] Repo role can close discussions",
      "is_traversable": false
    },
    {
      "name": "GH_ReopenDiscussion",
      "description": "[Repository] Repo role can reopen discussions",
      "is_traversable": false
    },
    {
      "name": "GH_EditCategoryOnDiscussion",
      "description": "[Repository] Repo role can change the category of a discussion",
      "is_traversable": false
    },
    {
      "name": "GH_ManageDiscussionBadges",
      "description": "[Repository] Repo role can manage discussion badges",
      "is_traversable": false
    },
    {
      "name": "GH_EditDiscussionComment",
      "description": "[Repository] Repo role can edit discussion comments",
      "is_traversable": false
    },
    {
      "name": "GH_DeleteDiscussionComment",
      "description": "[Repository] Repo role can delete discussion comments",
      "is_traversable": false
    },
    {
      "name": "GH_CreateTag",
      "description": "[Repository] Repo role can create tags and releases",
      "is_traversable": false
    },
    {
      "name": "GH_DeleteTag",
      "description": "[Repository] Repo role can delete tags and releases",
      "is_traversable": false
    },
    {
      "name": "GH_CreateRepository",
      "description": "[Organization] Org role can create repositories in the organization",
      "is_traversable": false
    },
    {
      "name": "GH_InviteMember",
      "description": "[Organization] Org role can invite members to the organization",
      "is_traversable": false
    },
    {
      "name": "GH_AddCollaborator",
      "description": "[Organization] Org role can add outside collaborators",
      "is_traversable": false
    },
    {
      "name": "GH_CreateTeam",
      "description": "[Organization] Org role can create teams in the organization",
      "is_traversable": false
    },
    {
      "name": "GH_TransferRepository",
      "description": "[Organization] Org role can transfer repositories",
      "is_traversable": false
    },
    {
      "name": "GH_ManageOrganizationWebhooks",
      "description": "[Organization] Org role can manage organization webhooks",
      "is_traversable": false
    },
    {
      "name": "GH_OrgBypassCodeScanningDismissalRequests",
      "description": "[Organization] Org role can bypass code scanning dismissal requests",
      "is_traversable": false
    },
    {
      "name": "GH_OrgBypassSecretScanningClosureRequests",
      "description": "[Organization] Org role can bypass secret scanning closure requests",
      "is_traversable": false
    },
    {
      "name": "GH_OrgReviewAndManageSecretScanningBypassRequests",
      "description": "[Organization] Org role can review and manage secret scanning bypass requests",
      "is_traversable": false
    },
    {
      "name": "GH_OrgReviewAndManageSecretScanningClosureRequests",
      "description": "[Organization] Org role can review and manage secret scanning closure requests",
      "is_traversable": false
    },
    {
      "name": "GH_ReadOrganizationActionsUsageMetrics",
      "description": "[Organization] Org role can read Actions usage metrics",
      "is_traversable": false
    },
    {
      "name": "GH_ReadOrganizationCustomOrgRole",
      "description": "[Organization] Org role can read custom org role definitions",
      "is_traversable": false
    },
    {
      "name": "GH_ReadOrganizationCustomRepoRole",
      "description": "[Organization] Org role can read custom repo role definitions",
      "is_traversable": false
    },
    {
      "name": "GH_ResolveSecretScanningAlerts",
      "description": "[Organization] Org role can resolve secret scanning alerts",
      "is_traversable": false
    },
    {
      "name": "GH_WriteOrganizationActionsSecrets",
      "description": "[Organization] Org role can write Actions secrets",
      "is_traversable": false
    },
    {
      "name": "GH_WriteOrganizationActionsVariables",
      "description": "[Organization] Org role can write Actions variables",
      "is_traversable": false
    },
    {
      "name": "GH_WriteOrganizationActionsSettings",
      "description": "[Organization] Org role can write Actions settings",
      "is_traversable": false
    },
    {
      "name": "GH_WriteOrganizationCustomOrgRole",
      "description": "[Organization] Org role can write custom org role definitions",
      "is_traversable": true
    },
    {
      "name": "GH_WriteOrganizationCustomRepoRole",
      "description": "[Organization] Org role can write custom repo role definitions",
      "is_traversable": false
    },
    {
      "name": "GH_WriteOrganizationNetworkConfigurations",
      "description": "[Organization] Org role can write network configurations",
      "is_traversable": false
    },
    {
      "name": "GH_BypassPullRequestAllowances",
      "description": "User or team can bypass pull request requirements on a branch protection rule",
      "is_traversable": false
    },
    {
      "name": "GH_RestrictionsCanPush",
      "description": "User or team is allowed to push to branches protected by this rule",
      "is_traversable": false
    },
    {
      "name": "GH_HasBranch",
      "description": "Repository has this branch",
      "is_traversable": false
    },
    {
      "name": "GH_CanEditProtection",
      "description": "[Repository - Computed] Repo role can modify or remove the branch protection rules governing this branch (computed from GH_EditRepoProtections + GH_ProtectedBy)",
      "is_traversable": true
    },
    {
      "name": "GH_CanReadSecretScanningAlert",
      "description": "[Computed] Role can read secret scanning alerts (computed from GH_ViewSecretScanningAlerts permission + GH_Contains)",
      "is_traversable": true
    },
    {
      "name": "GH_ProtectedBy",
      "description": "Branch protection rule protects this branch",
      "is_traversable": false
    },
    {
      "name": "GH_HasWorkflow",
      "description": "Repository has this workflow",
      "is_traversable": false
    },
    {
      "name": "GH_HasEnvironment",
      "description": "Repository or branch has/can deploy to this environment",
      "is_traversable": false
    },
    {
      "name": "GH_HasSecret",
      "description": "Repository or environment has access to this secret",
      "is_traversable": true
    },
    {
      "name": "GH_HasVariable",
      "description": "Repository has access to this variable (org-level or repo-level)",
      "is_traversable": true
    },
    {
      "name": "GH_ValidToken",
      "description": "Secret scanning alert contains a valid, active token belonging to this user",
      "is_traversable": true
    },
    {
      "name": "GH_HasSamlIdentityProvider",
      "description": "Organization has this SAML identity provider configured",
      "is_traversable": false
    },
    {
      "name": "GH_HasExternalIdentity",
      "description": "SAML identity provider has this external identity",
      "is_traversable": false
    },
    {
      "name": "GH_MapsToUser",
      "description": "External identity maps to a GitHub user or identity provider user",
      "is_traversable": false
    },
    {
      "name": "GH_HasPersonalAccessToken",
      "description": "User owns this personal access token that has been granted access to the organization",
      "is_traversable": false
    },
    {
      "name": "GH_HasPersonalAccessTokenRequest",
      "description": "User has a pending personal access token request for the organization",
      "is_traversable": false
    },
    {
      "name": "GH_InstalledAs",
      "description": "GitHub App is installed as this app installation on an organization",
      "is_traversable": true
    },
    {
      "name": "GH_CanAccess",
      "description": "Personal access token or app installation can access this repository or organization",
      "is_traversable": false
    },
    {
      "name": "GH_CanWriteBranch",
      "description": "[Repository - Computed] Role can push to this branch after evaluating branch protection rules, push restrictions, and bypass allowances",
      "is_traversable": true
    },
    {
      "name": "GH_CanCreateBranch",
      "description": "[Repository - Computed] Role can create new branches in this repository (unprotected branches that bypass the merge gate)",
      "is_traversable": true
    },
    {
      "name": "GH_CanAssumeIdentity",
      "description": "Repository can assume this cloud identity via OIDC federation (Azure workload identity or AWS IAM role)",
      "is_traversable": true
    },
    {
      "name": "GH_CanUseRunner",
      "description": "[Actions] Repository can dispatch jobs to this self-hosted runner",
      "is_traversable": false
    },
    {
      "name": "GH_CanDispatchTo",
      "description": "[Workflow] Job can dispatch to this self-hosted runner based on runs-on label matching and repository runner access",
      "is_traversable": false
    },
    {
      "name": "GH_SyncedTo",
      "description": "External identity (Azure, Okta, PingOne) is synced to this GitHub user via SSO/SCIM",
      "is_traversable": true
    },
    {
      "name": "GH_CallsWorkflow",
      "description": "[Workflow] Job calls a reusable workflow — GH_WorkflowJob → GH_Workflow",
      "is_traversable": false
    },
    {
      "name": "GH_CanPwnRequest",
      "description": "[Computed] Repo role can exploit a pwn-requestable workflow to execute arbitrary code with the target's secrets and permissions — GH_RepoRole → GH_Repository / GH_Branch",
      "is_traversable": true
    },
    {
      "name": "GH_DependsOn",
      "description": "[Workflow] Job must run after another job (needs: dependency) — ordering only, not an access path",
      "is_traversable": false
    },
    {
      "name": "GH_DeploysTo",
      "description": "[Workflow] Job deploys to a GitHub Environment — GH_WorkflowJob → GH_Environment",
      "is_traversable": false
    },
    {
      "name": "GH_HasJob",
      "description": "[Workflow] Workflow contains this job — GH_Workflow → GH_WorkflowJob",
      "is_traversable": false
    },
    {
      "name": "GH_HasMember",
      "description": "Enterprise or organization has this user as a member",
      "is_traversable": false
    },
    {
      "name": "GH_HasStep",
      "description": "[Workflow] Job contains this step — GH_WorkflowJob → GH_WorkflowStep",
      "is_traversable": false
    },
    {
      "name": "GH_UsesSecret",
      "description": "[Workflow] Step references a secret by name — GH_WorkflowStep → GH_RepoSecret / GH_OrgSecret (name match)",
      "is_traversable": false
    },
    {
      "name": "GH_UsesVariable",
      "description": "[Workflow] Step references a variable by name — GH_WorkflowStep → GH_RepoVariable / GH_OrgVariable (name match)",
      "is_traversable": false
    }
  ],
  "environments": [
    {
      "environment_kind": "GH_Organization",
      "source_kind": "GitHub",
      "principal_kinds": [
        "GH_User",
        "GH_Team",
        "GH_Repository",
        "GH_Branch",
        "GH_Environment"
      ]
    }
  ],
  "relationship_findings": []
}