openhound-github 0.19.0__tar.gz → 0.20.1__tar.gz

{openhound_github-0.19.0 → openhound_github-0.20.1}/.github/CODE_OF_CONDUCT.md

@@ -1,6 +1,6 @@
 <p align="center">
   <a href="https://community.specterops.io/" target="_blank">
-    <img alt="Community of SpecterOps - Creators of BloodHound" src=".github/GitHub-COC-Header.png" width="100%" style="max-width: 100%;">
+    <img alt="Community of SpecterOps - Creators of BloodHound" src="https://raw.githubusercontent.com/SpecterOps/OpenHound/refs/heads/main/.github/GitHub-COC-Header.png" width="100%" style="max-width: 100%;">
   </a>
 </p>
 

{openhound_github-0.19.0 → openhound_github-0.20.1}/.github/CONTRIBUTING.md

@@ -1,6 +1,6 @@
 <p align="center">
   <a href="https://community.specterops.io/" target="_blank">
-    <img alt="Community of SpecterOps - Creators of BloodHound" src=".github/GitHub-CONTRIB-Header.png" width="100%" style="max-width: 100%;">
+    <img alt="Community of SpecterOps - Creators of BloodHound" src="https://raw.githubusercontent.com/SpecterOps/OpenHound/refs/heads/main/.github/GitHub-CONTRIB-Header.png" width="100%" style="max-width: 100%;">
   </a>
 </p>
 

{openhound_github-0.19.0 → openhound_github-0.20.1}/.github/GOVERNANCE.md

@@ -1,6 +1,6 @@
 <p align="center">
   <a href="https://community.specterops.io/" target="_blank">
-    <img alt="Community of SpecterOps - Creators of BloodHound" src=".github/GitHub-GOV-Header.png" width="100%" style="max-width: 100%;">
+    <img alt="Community of SpecterOps - Creators of BloodHound" src="https://raw.githubusercontent.com/SpecterOps/OpenHound/refs/heads/main/.github/GitHub-GOV-Header.png" width="100%" style="max-width: 100%;">
   </a>
 </p>
 

{openhound_github-0.19.0 → openhound_github-0.20.1}/.github/SECURITY.md

@@ -1,6 +1,6 @@
 <p align="center">
   <a href="https://specterops.io/" target="_blank">
-    <img alt="Community of SpecterOps - Creators of BloodHound" src=".github/GitHub-SEC-Header.png" width="100%" style="max-width: 100%;">
+    <img alt="Community of SpecterOps - Creators of BloodHound" src="https://raw.githubusercontent.com/SpecterOps/OpenHound/refs/heads/main/.github/GitHub-SEC-Header.png" width="100%" style="max-width: 100%;">
   </a>
 </p>
 

{openhound_github-0.19.0 → openhound_github-0.20.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.19.0
+Version: 0.20.1
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md
@@ -11,7 +11,7 @@ Description-Content-Type: text/markdown
 
 <p align="center">
   <a href="https://specterops.io" target="_blank">
-    <img alt="A project powered by SpecterOps - Creators of BloodHound" src=".github/GitHub-Header.png" width="100%" style="max-width: 100%;">
+    <img alt="A project powered by SpecterOps - Creators of BloodHound" src="https://raw.githubusercontent.com/SpecterOps/OpenHound/refs/heads/main/.github/GitHub-Header.png" width="100%" style="max-width: 100%;">
   </a>
 </p>
 

{openhound_github-0.19.0 → openhound_github-0.20.1}/README.md

@@ -1,6 +1,6 @@
 <p align="center">
   <a href="https://specterops.io" target="_blank">
-    <img alt="A project powered by SpecterOps - Creators of BloodHound" src=".github/GitHub-Header.png" width="100%" style="max-width: 100%;">
+    <img alt="A project powered by SpecterOps - Creators of BloodHound" src="https://raw.githubusercontent.com/SpecterOps/OpenHound/refs/heads/main/.github/GitHub-Header.png" width="100%" style="max-width: 100%;">
   </a>
 </p>
 

{openhound_github-0.19.0 → openhound_github-0.20.1}/descriptions/edges/GH_CanAccess.md

@@ -2,16 +2,18 @@
 
 ## General Information
 
-The non-traversable GH_CanAccess edge indicates that a personal access token, app installation, or deploy key has been granted access to a repository or organization. This edge represents the scope of access granted to a non-human credential rather than a direct attack path, providing visibility into which repositories are reachable through that credential. It is non-traversable because credential access does not transitively extend to other principals.
+The non-traversable GH_CanAccess edge indicates that a personal access token, app installation, or deploy key has been granted access to a repository, reusable scope, or organization. All-repository app installations and PATs point to an organization-scoped GH_Scope with `scope_type=repository` instead of repeating an edge to every repository. This edge represents access scope rather than a direct attack path.
 
 ## Edge Schema
 
 | Source | Destination | Traversable |
 | --- | --- | --- |
 | `GH_AppInstallation` | `GH_Repository` | `false` |
+| `GH_AppInstallation` | `GH_Scope` | `false` |
 | `GH_DeployKey` | `GH_Repository` | `false` |
 | `GH_PersonalAccessToken` | `GH_Organization` | `false` |
 | `GH_PersonalAccessToken` | `GH_Repository` | `false` |
+| `GH_PersonalAccessToken` | `GH_Scope` | `false` |
 
 ## Diagram
 
@@ -19,11 +21,14 @@ The non-traversable GH_CanAccess edge indicates that a personal access token, ap
 graph LR
     n0["GH_AppInstallation"]
     n1["GH_Repository"]
-    n2["GH_DeployKey"]
-    n3["GH_PersonalAccessToken"]
-    n4["GH_Organization"]
+    n2["GH_Scope"]
+    n3["GH_DeployKey"]
+    n4["GH_PersonalAccessToken"]
+    n5["GH_Organization"]
     n0 -.->|GH_CanAccess| n1
-    n2 -.->|GH_CanAccess| n1
-    n3 -.->|GH_CanAccess| n4
+    n0 -.->|GH_CanAccess| n2
     n3 -.->|GH_CanAccess| n1
+    n4 -.->|GH_CanAccess| n5
+    n4 -.->|GH_CanAccess| n1
+    n4 -.->|GH_CanAccess| n2
 ```

openhound_github-0.20.1/descriptions/edges/GH_CanReadSecret.md

@@ -0,0 +1,25 @@
+# GH_CanReadSecret
+
+## General Information
+
+Org role can read organization secrets by creating a repository in the matching organization-secret scope. The collector emits this relationship from the role to a reusable `GH_Scope`; `GH_ScopedTo` expands the scope to its `all` or `private_or_internal` organization secrets. Selected secrets do not receive this derived capability because creating a repository does not add that repository to an arbitrary selected set.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_OrgRole` | `GH_OrgSecret` | `true` |
+| `GH_OrgRole` | `GH_Scope` | `true` |
+
+`GH_OrgRole` to `GH_OrgSecret` remains an accepted legacy schema endpoint. Current OpenHound collections emit `GH_OrgRole` to `GH_Scope` instead.
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_OrgRole"]
+    n1["GH_Scope"]
+    n2["GH_OrgSecret"]
+    n0 -->|GH_CanReadSecret| n1
+    n1 -->|GH_ScopedTo| n2
+```

{openhound_github-0.19.0 → openhound_github-0.20.1}/descriptions/edges/GH_CanUseRunner.md

@@ -4,7 +4,7 @@
 
 For runner-group-backed access, the traversable GH_CanUseRunner edge is a computed edge representing that a repository or branch can dispatch workflows to a self-hosted runner execution surface under the modeled runner-group controls.
 
-The collector derives this edge from GH_IsEligibleFor rather than directly from repository visibility. It emits GH_CanUseRunner only when the repository is within the runner group's repository-access scope, GitHub Actions is enabled for the repository, and `restricted_to_workflows=false` on the organization-facing runner group. Inherited enterprise-backed access also requires `restricted_to_workflows=false` on the source GH_EnterpriseRunnerGroup. Every collected branch in a repository that satisfies those conditions receives the same edge so branch write paths can reach the execution surface.
+The collector derives this edge from the same underlying eligibility policy represented by GH_IsEligibleFor. It emits GH_CanUseRunner only when the repository is within the runner group's repository-access scope, GitHub Actions is enabled for the repository, and `restricted_to_workflows=false` on the organization-facing runner group. Inherited enterprise-backed access also requires `restricted_to_workflows=false` on the source GH_EnterpriseRunnerGroup. Every collected branch in a repository that satisfies those conditions receives the same edge so branch write paths can reach the execution surface.
 
 Organization and inherited enterprise-backed access terminate at the organization-facing GH_OrgRunnerGroup, then continue through GH_HasRunner for native organization runners or through GH_InheritedFrom and GH_HasRunner for inherited enterprise runners. Repository-scoped runners currently receive GH_CanUseRunner directly from their containing repository and are not part of this runner-group traversability change.
 

{openhound_github-0.19.0 → openhound_github-0.20.1}/descriptions/edges/GH_Contains.md

@@ -2,7 +2,7 @@
 
 ## General Information
 
-The non-traversable GH_Contains edge represents structural containment within the GitHub resource hierarchy. The enterprise contains enterprise teams, roles, managed users, classic personal access tokens, runner groups, and enterprise runners through their groups. The organization serves as a top-level container for users, teams, repositories, roles, secrets, app installations, fine-grained personal access tokens, and organization runner groups. Native organization runner groups contain organization runners. Repositories contain branches, workflows, branch protection rules, environments, repo-level secrets and variables, and repository-scoped runners. Environments contain environment branch policies, environment-scoped secrets, and environment-scoped variables. This edge is created by the collector to establish the resource hierarchy and is not traversable because containment alone does not imply privilege escalation.
+The non-traversable GH_Contains edge represents structural containment within the GitHub resource hierarchy. The enterprise contains enterprise teams, roles, managed users, classic personal access tokens, runner groups, and enterprise runners through their groups. The organization serves as a top-level container for users, teams, repositories, roles, scopes, secrets, app installations, fine-grained personal access tokens, and organization runner groups. Native organization runner groups contain organization runners. Repositories contain branches, workflows, branch protection rules, environments, repo-level secrets and variables, and repository-scoped runners. Environments contain environment branch policies, environment-scoped secrets, and environment-scoped variables. This edge is created by the collector to establish the resource hierarchy and is not traversable because containment alone does not imply privilege escalation.
 
 ## Edge Schema
 
@@ -25,6 +25,7 @@ The non-traversable GH_Contains edge represents structural containment within th
 | `GH_Organization` | `GH_OrgVariable` | `false` |
 | `GH_Organization` | `GH_PersonalAccessToken` | `false` |
 | `GH_Organization` | `GH_PersonalAccessTokenRequest` | `false` |
+| `GH_Organization` | `GH_Scope` | `false` |
 | `GH_Organization` | `GH_SecretScanningAlert` | `false` |
 | `GH_Repository` | `GH_Branch` | `false` |
 | `GH_Repository` | `GH_BranchProtectionRule` | `false` |
@@ -61,17 +62,18 @@ graph LR
     n16["GH_OrgVariable"]
     n17["GH_PersonalAccessToken"]
     n18["GH_PersonalAccessTokenRequest"]
-    n19["GH_SecretScanningAlert"]
-    n20["GH_Repository"]
-    n21["GH_Branch"]
-    n22["GH_BranchProtectionRule"]
-    n23["GH_DeployKey"]
-    n24["GH_RepoRunner"]
-    n25["GH_RepoSecret"]
-    n26["GH_RepoVariable"]
-    n27["GH_Workflow"]
-    n28["GH_WorkflowJob"]
-    n29["GH_WorkflowStep"]
+    n19["GH_Scope"]
+    n20["GH_SecretScanningAlert"]
+    n21["GH_Repository"]
+    n22["GH_Branch"]
+    n23["GH_BranchProtectionRule"]
+    n24["GH_DeployKey"]
+    n25["GH_RepoRunner"]
+    n26["GH_RepoSecret"]
+    n27["GH_RepoVariable"]
+    n28["GH_Workflow"]
+    n29["GH_WorkflowJob"]
+    n30["GH_WorkflowStep"]
     n0 -.->|GH_Contains| n1
     n0 -.->|GH_Contains| n2
     n0 -.->|GH_Contains| n3
@@ -90,15 +92,16 @@ graph LR
     n5 -.->|GH_Contains| n17
     n5 -.->|GH_Contains| n18
     n5 -.->|GH_Contains| n19
-    n20 -.->|GH_Contains| n21
-    n20 -.->|GH_Contains| n22
-    n20 -.->|GH_Contains| n23
-    n20 -.->|GH_Contains| n7
-    n20 -.->|GH_Contains| n24
-    n20 -.->|GH_Contains| n25
-    n20 -.->|GH_Contains| n26
-    n20 -.->|GH_Contains| n19
-    n20 -.->|GH_Contains| n27
-    n27 -.->|GH_Contains| n28
+    n5 -.->|GH_Contains| n20
+    n21 -.->|GH_Contains| n22
+    n21 -.->|GH_Contains| n23
+    n21 -.->|GH_Contains| n24
+    n21 -.->|GH_Contains| n7
+    n21 -.->|GH_Contains| n25
+    n21 -.->|GH_Contains| n26
+    n21 -.->|GH_Contains| n27
+    n21 -.->|GH_Contains| n20
+    n21 -.->|GH_Contains| n28
     n28 -.->|GH_Contains| n29
+    n29 -.->|GH_Contains| n30
 ```

{openhound_github-0.19.0 → openhound_github-0.20.1}/descriptions/edges/GH_HasSecret.md

@@ -2,7 +2,7 @@
 
 ## General Information
 
-The traversable GH_HasSecret edge represents the relationship between a repository or environment and the secrets accessible within that context. This edge shows which secrets are available in which scopes. Repositories can have access to both organization-level secrets (scoped to selected repositories) and repository-level secrets, while environments expose their own environment-scoped secrets to jobs that target them. This edge is traversable because any principal that can execute a workflow in the relevant context may be able to exfiltrate secret values at runtime, making this a meaningful link in attack path analysis.
+The traversable GH_HasSecret edge represents the relationship between a repository or environment and the secrets accessible within that context. Canonical all/private organization-secret availability is factored through a GH_Scope; selected organization secrets and repository/environment secrets remain direct. This edge is traversable because any principal that can execute a workflow in the relevant context may be able to exfiltrate secret values at runtime, making this a meaningful link in attack path analysis.
 
 ## Edge Schema
 
@@ -11,6 +11,7 @@ The traversable GH_HasSecret edge represents the relationship between a reposito
 | `GH_Environment` | `GH_EnvironmentSecret` | `true` |
 | `GH_Repository` | `GH_OrgSecret` | `true` |
 | `GH_Repository` | `GH_RepoSecret` | `true` |
+| `GH_Repository` | `GH_Scope` | `true` |
 
 ## Diagram
 
@@ -21,7 +22,9 @@ graph LR
     n2["GH_Repository"]
     n3["GH_OrgSecret"]
     n4["GH_RepoSecret"]
+    n5["GH_Scope"]
     n0 -->|GH_HasSecret| n1
     n2 -->|GH_HasSecret| n3
     n2 -->|GH_HasSecret| n4
+    n2 -->|GH_HasSecret| n5
 ```

{openhound_github-0.19.0 → openhound_github-0.20.1}/descriptions/edges/GH_HasVariable.md

@@ -2,7 +2,7 @@
 
 ## General Information
 
-The traversable GH_HasVariable edge represents the relationship between a repository or environment and the variables accessible within that context. This edge shows which variables are available in which scopes. Repositories can have access to both organization-level variables (scoped by visibility to all, private, or selected repositories) and repository-level variables defined directly on the repo, while environments expose their own environment-scoped variables to jobs that target them. This edge is traversable because any principal that can execute a workflow in the relevant context may be able to read variable values at runtime, and variables may contain configuration data useful for lateral movement such as deployment URLs, service names, or environment identifiers.
+The traversable GH_HasVariable edge represents the relationship between a repository or environment and the variables accessible within that context. Canonical all/private organization-variable availability is factored through a GH_Scope; selected organization variables and repository/environment variables remain direct.
 
 ## Edge Schema
 
@@ -11,6 +11,7 @@ The traversable GH_HasVariable edge represents the relationship between a reposi
 | `GH_Environment` | `GH_EnvironmentVariable` | `true` |
 | `GH_Repository` | `GH_OrgVariable` | `true` |
 | `GH_Repository` | `GH_RepoVariable` | `true` |
+| `GH_Repository` | `GH_Scope` | `true` |
 
 ## Diagram
 
@@ -21,7 +22,9 @@ graph LR
     n2["GH_Repository"]
     n3["GH_OrgVariable"]
     n4["GH_RepoVariable"]
+    n5["GH_Scope"]
     n0 -->|GH_HasVariable| n1
     n2 -->|GH_HasVariable| n3
     n2 -->|GH_HasVariable| n4
+    n2 -->|GH_HasVariable| n5
 ```

{openhound_github-0.19.0 → openhound_github-0.20.1}/descriptions/edges/GH_IsEligibleFor.md

@@ -2,7 +2,7 @@
 
 ## General Information
 
-The non-traversable GH_IsEligibleFor edge represents that a repository is within the repository-access scope of an organization runner group.
+The non-traversable GH_IsEligibleFor edge represents that a repository is within the repository-access policy of an organization runner group. Canonical `all` and `private_or_internal` eligibility is factored through a GH_Scope; arbitrary selected eligibility remains a direct relationship.
 
 For runner groups, this edge evaluates the group's `visibility`, selected repository assignments, and `allows_public_repositories` setting. It does not prove that workflows in the repository can dispatch to the group's runners, because GitHub Actions may be disabled for the repository or the runner group may be restricted to selected workflows.
 
@@ -11,6 +11,7 @@ For runner groups, this edge evaluates the group's `visibility`, selected reposi
 | Source | Destination | Traversable |
 | --- | --- | --- |
 | `GH_Repository` | `GH_OrgRunnerGroup` | `false` |
+| `GH_Repository` | `GH_Scope` | `false` |
 
 ## Diagram
 
@@ -18,5 +19,7 @@ For runner groups, this edge evaluates the group's `visibility`, selected reposi
 graph LR
     n0["GH_Repository"]
     n1["GH_OrgRunnerGroup"]
+    n2["GH_Scope"]
     n0 -.->|GH_IsEligibleFor| n1
+    n0 -.->|GH_IsEligibleFor| n2
 ```

openhound_github-0.20.1/descriptions/edges/GH_RequestsAccessTo.md

@@ -0,0 +1,20 @@
+# GH_RequestsAccessTo
+
+## General Information
+
+The non-traversable GH_RequestsAccessTo edge records access sought by a pending fine-grained personal access token request. It is distinct from GH_CanAccess, which represents access GitHub has already granted. An all-repository request targets the organization's reusable repository/all GH_Scope.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_PersonalAccessTokenRequest` | `GH_Scope` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_PersonalAccessTokenRequest"]
+    n1["GH_Scope"]
+    n0 -.->|GH_RequestsAccessTo| n1
+```

openhound_github-0.20.1/descriptions/edges/GH_ScopedTo.md

@@ -0,0 +1,29 @@
+# GH_ScopedTo
+
+## General Information
+
+The traversable GH_ScopedTo edge enumerates an asset included in a reusable GH_Scope. It carries an incoming capability from a target scope to each asset in the represented set. Repository scopes contain collected repositories, runner-group scopes contain organization-facing runner groups sharing repository eligibility, and organization-secret/variable scopes contain assets sharing repository availability.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_Scope` | `GH_OrgRunnerGroup` | `true` |
+| `GH_Scope` | `GH_OrgSecret` | `true` |
+| `GH_Scope` | `GH_OrgVariable` | `true` |
+| `GH_Scope` | `GH_Repository` | `true` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_Scope"]
+    n1["GH_OrgRunnerGroup"]
+    n2["GH_OrgSecret"]
+    n3["GH_OrgVariable"]
+    n4["GH_Repository"]
+    n0 -->|GH_ScopedTo| n1
+    n0 -->|GH_ScopedTo| n2
+    n0 -->|GH_ScopedTo| n3
+    n0 -->|GH_ScopedTo| n4
+```

{openhound_github-0.19.0 → openhound_github-0.20.1}/descriptions/nodes/GH_AppInstallation.md

@@ -6,7 +6,7 @@ Represents a GitHub App installed on an organization. App installations have spe
 
 Unlike fine-grained personal access tokens, GitHub does not expose separate organization and repository permission buckets for app installations, so this property remains a single flat permission list.
 
-Each installation is linked to its parent GH_App via a GH_InstalledAs edge. For installations with `repository_selection` set to `all`, GH_CanAccess edges are created to every collected repository in the organization. For installations with `repository_selection` set to `selected`, the collector uses the enterprise organization-installation repositories API to enumerate the granted repositories when the enterprise installation has `Enterprise organization installations: read` or `Enterprise organization installation repositories: read`. If that permission is unavailable, selected repository edges are skipped.
+Each installation is linked to its parent GH_App via a GH_InstalledAs edge. Installations with `repository_selection` set to `all` use one GH_CanAccess edge to the organization's repository/all GH_Scope; GH_ScopedTo edges enumerate the repositories in that reusable scope. For installations with `repository_selection` set to `selected`, the collector uses the enterprise organization-installation repositories API to enumerate the granted repositories when the enterprise installation has `Enterprise organization installations: read` or `Enterprise organization installation repositories: read`. If that permission is unavailable, selected repository edges are skipped.
 
 ## Properties
 
@@ -42,8 +42,10 @@ graph LR
     n0["GH_App"]
     n1["GH_AppInstallation"]
     n2["GH_Repository"]
-    n3["GH_Organization"]
+    n3["GH_Scope"]
+    n4["GH_Organization"]
     n0 -->|GH_InstalledAs| n1
     n1 -.->|GH_CanAccess| n2
-    n3 -.->|GH_Contains| n1
+    n1 -.->|GH_CanAccess| n3
+    n4 -.->|GH_Contains| n1
 ```

{openhound_github-0.19.0 → openhound_github-0.20.1}/descriptions/nodes/GH_Environment.md

@@ -58,5 +58,6 @@ graph LR
     n7 -->|GH_CanDeployToEnvironment| n1
     n8 -.->|GH_ApprovesDeploymentTo| n1
     n8 -->|GH_CanDeployToEnvironment| n1
+    n9 -->|GH_CanRequestOIDCTokenFor| n1
     n9 -.->|GH_DeploysTo| n1
 ```

{openhound_github-0.19.0 → openhound_github-0.20.1}/descriptions/nodes/GH_OrgRole.md

@@ -29,12 +29,12 @@ graph LR
     n1["GH_OrgRunnerGroup"]
     n2["GH_OrgSecret"]
     n3["GH_Organization"]
-    n4["GH_SecretScanningAlert"]
-    n5["GH_Team"]
-    n6["GH_User"]
+    n4["GH_Scope"]
+    n5["GH_SecretScanningAlert"]
+    n6["GH_Team"]
+    n7["GH_User"]
     n0 -->|GH_HasBaseRole| n0
     n0 -->|GH_CanCreateRepositoryWithRunnerAccess| n1
-    n0 -->|GH_CanReadSecret| n2
     n0 -.->|GH_AddCollaborator| n3
     n0 -.->|GH_CanCreateInternalRepositories| n3
     n0 -.->|GH_CanCreatePrivateRepositories| n3
@@ -45,8 +45,10 @@ graph LR
     n0 -.->|GH_ResolveSecretScanningAlerts| n3
     n0 -.->|GH_TransferRepository| n3
     n0 -.->|GH_ViewSecretScanningAlerts| n3
-    n0 -->|GH_CanReadSecretScanningAlert| n4
+    n0 -->|GH_CanReadSecret| n4
+    n4 -->|GH_ScopedTo| n2
+    n0 -->|GH_CanReadSecretScanningAlert| n5
     n3 -.->|GH_Contains| n0
-    n5 -->|GH_HasRole| n0
     n6 -->|GH_HasRole| n0
+    n7 -->|GH_HasRole| n0
 ```

{openhound_github-0.19.0 → openhound_github-0.20.1}/descriptions/nodes/GH_OrgRunnerGroup.md

@@ -4,7 +4,7 @@
 
 Represents a self-hosted runner group visible within a GitHub organization. Organization runner groups may either be native to the organization or inherited from an enterprise runner group.
 
-Native organization runner groups contain GH_OrgRunner nodes directly. Direct memberships also emit GH_HasRunner to represent the traversable capability hop from the group to its runners. Inherited organization runner groups do not directly contain organization runners; instead, they link to the source GH_EnterpriseRunnerGroup through GH_InheritedFrom and gain access to the enterprise runners contained there. GH_IsEligibleFor edges from repositories describe repository access policy scope, while GH_CanUseRunner edges identify repositories and branches that can dispatch workflows to the group under the collected Actions and workflow-restriction settings.
+Native organization runner groups contain GH_OrgRunner nodes directly. Direct memberships also emit GH_HasRunner to represent the traversable capability hop from the group to its runners. Inherited organization runner groups do not directly contain organization runners; instead, they link to the source GH_EnterpriseRunnerGroup through GH_InheritedFrom and gain access to the enterprise runners contained there. GH_IsEligibleFor uses shared runner-group scopes for canonical policies and direct edges for selected policies, while GH_CanUseRunner identifies repositories and branches that can dispatch workflows to the group under collected Actions and workflow-restriction settings.
 
 ## Properties
 
@@ -42,6 +42,7 @@ graph LR
     n4["GH_OrgRunner"]
     n5["GH_Organization"]
     n6["GH_Repository"]
+    n7["GH_Scope"]
     n0 -->|GH_CanUseRunner| n1
     n2 -->|GH_CanCreateRepositoryWithRunnerAccess| n1
     n1 -->|GH_InheritedFrom| n3
@@ -50,4 +51,5 @@ graph LR
     n5 -.->|GH_Contains| n1
     n6 -->|GH_CanUseRunner| n1
     n6 -.->|GH_IsEligibleFor| n1
+    n7 -->|GH_ScopedTo| n1
 ```

{openhound_github-0.19.0 → openhound_github-0.20.1}/descriptions/nodes/GH_OrgSecret.md

@@ -2,7 +2,7 @@
 
 ## General Information
 
-Represents an organization-level GitHub Actions secret. Organization secrets can be scoped to all repositories, only private/internal repositories, or a specific set of selected repositories. The visibility property determines how GH_HasSecret edges are resolved to repository nodes.
+Represents an organization-level GitHub Actions secret. All and private/internal visibility uses shared organization-secret GH_Scope nodes; arbitrary selected visibility uses direct GH_HasSecret relationships from repositories.
 
 ## Properties
 
@@ -28,12 +28,14 @@ graph LR
     n1["GH_OrgSecret"]
     n2["GH_Organization"]
     n3["GH_Repository"]
-    n4["GH_WorkflowJob"]
-    n5["GH_WorkflowStep"]
-    n0 -->|GH_CanReadSecret| n1
+    n4["GH_Scope"]
+    n5["GH_WorkflowJob"]
+    n6["GH_WorkflowStep"]
     n2 -.->|GH_Contains| n1
     n3 -->|GH_HasSecret| n1
-    n4 -->|GH_CanAccessSecret| n1
-    n4 -.->|GH_UsesSecret| n1
+    n0 -->|GH_CanReadSecret| n4
+    n4 -->|GH_ScopedTo| n1
+    n5 -->|GH_CanAccessSecret| n1
     n5 -.->|GH_UsesSecret| n1
+    n6 -.->|GH_UsesSecret| n1
 ```

{openhound_github-0.19.0 → openhound_github-0.20.1}/descriptions/nodes/GH_OrgVariable.md

@@ -2,7 +2,7 @@
 
 ## General Information
 
-Represents an organization-level GitHub Actions variable. Organization variables can be scoped to all repositories, only private/internal repositories, or a specific set of selected repositories. The visibility property determines how GH_HasVariable edges are resolved to repository nodes. Unlike secrets, variable values are readable via the API.
+Represents an organization-level GitHub Actions variable. All and private/internal visibility uses shared organization-variable GH_Scope nodes; arbitrary selected visibility uses direct GH_HasVariable relationships from repositories. Unlike secrets, variable values are readable via the API.
 
 ## Properties
 
@@ -27,10 +27,12 @@ graph LR
     n0["GH_Organization"]
     n1["GH_OrgVariable"]
     n2["GH_Repository"]
-    n3["GH_WorkflowJob"]
-    n4["GH_WorkflowStep"]
+    n3["GH_Scope"]
+    n4["GH_WorkflowJob"]
+    n5["GH_WorkflowStep"]
     n0 -.->|GH_Contains| n1
     n2 -->|GH_HasVariable| n1
-    n3 -.->|GH_UsesVariable| n1
+    n3 -->|GH_ScopedTo| n1
     n4 -.->|GH_UsesVariable| n1
+    n5 -.->|GH_UsesVariable| n1
 ```

{openhound_github-0.19.0 → openhound_github-0.20.1}/descriptions/nodes/GH_Organization.md

@@ -104,6 +104,7 @@ graph LR
     n11["GH_Repository"]
     n12["GH_SamlIdentityProvider"]
     n13["GH_SecretScanningAlert"]
+    n14["GH_Scope"]
     n0 -.->|GH_AuthorizedForOrganization| n1
     n2 -.->|GH_Contains| n1
     n3 -.->|GH_AssignedTo| n1
@@ -127,5 +128,6 @@ graph LR
     n1 -->|GH_Owns| n11
     n1 -.->|GH_HasSamlIdentityProvider| n12
     n1 -.->|GH_Contains| n13
+    n1 -.->|GH_Contains| n14
     n9 -.->|GH_CanAccess| n1
 ```

{openhound_github-0.19.0 → openhound_github-0.20.1}/descriptions/nodes/GH_PersonalAccessToken.md

@@ -2,7 +2,7 @@
 
 ## General Information
 
-Represents a fine-grained personal access token that has been granted access to organization resources. PATs are linked to their owning user, the organization, and the repositories they can access.
+Represents a fine-grained personal access token that has been granted access to organization resources. PATs are linked to their owning user, the organization, and the repositories they can access. PATs with `repository_selection` set to `all` use the organization's reusable repository/all GH_Scope; subset access remains represented by direct GH_CanAccess edges.
 
 The granted permissions are stored separately as `organization_permissions` and `repository_permissions`. Each property is a list of `scope:access` values such as `members:read` or `contents:write`, matching the permission format used on GH_WorkflowJob nodes.
 
@@ -38,9 +38,11 @@ graph LR
     n0["GH_Organization"]
     n1["GH_PersonalAccessToken"]
     n2["GH_Repository"]
-    n3["GH_User"]
+    n3["GH_Scope"]
+    n4["GH_User"]
     n0 -.->|GH_Contains| n1
     n1 -.->|GH_CanAccess| n0
     n1 -.->|GH_CanAccess| n2
-    n3 -.->|GH_HasPersonalAccessToken| n1
+    n1 -.->|GH_CanAccess| n3
+    n4 -.->|GH_HasPersonalAccessToken| n1
 ```

{openhound_github-0.19.0 → openhound_github-0.20.1}/descriptions/nodes/GH_PersonalAccessTokenRequest.md

@@ -2,7 +2,7 @@
 
 ## General Information
 
-Represents a pending request from an organization member to access organization resources with a fine-grained personal access token. PAT requests are linked to their owning user and the organization.
+Represents a pending request from an organization member to access organization resources with a fine-grained personal access token. PAT requests are linked to their owning user and the organization. An all-repository request also has a non-traversable GH_RequestsAccessTo edge to the organization's repository/all GH_Scope.
 
 The requested permissions are stored separately as `organization_permissions` and `repository_permissions`. Each property is a list of `scope:access` values such as `members:read` or `contents:write`, matching the permission format used on GH_WorkflowJob nodes.
 
@@ -32,7 +32,9 @@ The requested permissions are stored separately as `organization_permissions` an
 graph LR
     n0["GH_Organization"]
     n1["GH_PersonalAccessTokenRequest"]
-    n2["GH_User"]
+    n2["GH_Scope"]
+    n3["GH_User"]
     n0 -.->|GH_Contains| n1
-    n2 -.->|GH_HasPersonalAccessTokenRequest| n1
+    n1 -.->|GH_RequestsAccessTo| n2
+    n3 -.->|GH_HasPersonalAccessTokenRequest| n1
 ```

{openhound_github-0.19.0 → openhound_github-0.20.1}/descriptions/nodes/GH_Repository.md

@@ -8,6 +8,14 @@ For repositories with active workflows, the collector records the applicable def
 
 The `branch_count` and `environment_count` properties preserve GitHub-reported totals from the repository GraphQL response. These values can be compared to collected GH_Branch and GH_Environment children to identify incomplete collection before relying on branch- or environment-dependent analysis.
 
+Every repository is linked from its organization's reusable repository/all GH_Scope. Private and internal repositories are also linked from repository/private_or_internal. This supports compact one- or two-hop access queries without repeating one GH_CanAccess edge per credential and repository.
+
+Repositories also point to runner_group/all GH_Scope nodes through GH_IsEligibleFor; private and internal repositories additionally point to runner_group/private_or_internal. Those scopes enumerate canonical runner groups through GH_ScopedTo, while groups with arbitrary selected repository policies remain direct.
+
+Organization secrets and variables with canonical all/private visibility are similarly reached through organization_secret and organization_variable scopes. Repository-owned, environment-owned, and arbitrarily selected organization assets remain direct targets.
+
+Runner, secret, and variable boundary edges are emitted only when the organization has a matching canonical target, so empty scopes do not add per-repository edges.
+
 ## Properties
 
 | Property | Type | Description |
@@ -87,8 +95,9 @@ graph LR
     n12["GH_RepoRunner"]
     n13["GH_RepoSecret"]
     n14["GH_RepoVariable"]
-    n15["GH_SecretScanningAlert"]
-    n16["GH_Workflow"]
+    n15["GH_Scope"]
+    n16["GH_SecretScanningAlert"]
+    n17["GH_Workflow"]
     n0 -.->|GH_CanAccess| n1
     n2 -.->|GH_CanAccess| n1
     n3 -->|GH_Owns| n1
@@ -169,6 +178,10 @@ graph LR
     n1 -->|GH_HasSecret| n13
     n1 -.->|GH_Contains| n14
     n1 -->|GH_HasVariable| n14
-    n1 -.->|GH_Contains| n15
+    n1 -->|GH_HasSecret| n15
+    n1 -->|GH_HasVariable| n15
+    n1 -.->|GH_IsEligibleFor| n15
     n1 -.->|GH_Contains| n16
+    n1 -.->|GH_Contains| n17
+    n15 -->|GH_ScopedTo| n1
 ```