svanboxel/org-audit-action

GitHub Action that provides an Organization Membership Audit

GitHub Membership Audit Action

GitHub Action that provides an Enterprise Account or Organization Audit of members, repositories and which permissions these members have. The output of this action is a published CSV file in the Actions tab. The user can also configure the action to publish the results to an issue.

The output looks like this running on enterprise mode:

enterprise	organization	repo	user	login	permission
goodcorp	goodcorp-os	node-utils	Vitor Monteiro	bitoiu	ADMIN
goodcorp	goodcorp-os	node-utils	Richard Erwin	rerwinx	ADMIN
goodcorp	goodcorp-os	node-utils	Kai Hilton-Jones	evil-clone	WRITE
goodcorp	core	innersource-docs	Vitor Monteiro	bitoiu	ADMIN
goodcorp	core	innersource-docs	Richard Erwin	rerwinx	READ

Action configuration overview

 - name: Membership Audit Log Action
      uses: svanboxel/org-audit-action@master
      with:
        ## `organization` and `enterprise` are mutually exclusive
        enterprise: 'goodcorp'  
        ## repo, read:org, read:enterprise (if running with enterprise option)
        token: ${{ secrets.TOKEN }}
        ## issue is optional
        issue: true
        ## samlIdentities is optional
        samlIdentities: true
        ## affiliation is optional - values are 'ALL', 'DIRECT' (i.e. members only) or 'OUTSIDE' (i.e. outside collaborators only)
        affiliation: 'ALL'

Example workflows

Depending on your needs you might want to trigger the audit on different events. The simplest one to test it out is to trigger the workflow on push. For this workflow to run properly you'll need to provide it with a secret personal access token from someone that is an org owner or from an application that has that privilege. Providing it a lesser scope might not show all the information for the organization.

Single org-audit audit on push (good for testing)

The action in the following workflow is configured to:

• Work only on a single organization
• Expose the linked SAML nameId field for your members if your organization is using SAML SSO and you want to retrieve this info (generally a corporate email address used to login with SSO)
• Publish results also to an issue

on: push

jobs:

  audit_log:
    runs-on: ubuntu-latest
    name: Membership Audit Log

    - name: Membership Audit Log Action
      uses: svanboxel/org-audit-action@v1
      with:
        organization: 'octodemov2'
        token: ${{ secrets.TOKEN }}
        issue: true
        samlIdentities: true

Enterprise Account audit on a schedule (cron)

The action in the following workflow is configured to:

• Work on an enterprise account
• Publish results also to an issue

on:
  schedule:   
    # Once a week on Saturday 00:00
    - cron:  '0 0 * * 6'

jobs:

  audit_log:
    runs-on: ubuntu-latest
    name: Membership Audit Log

    - name: Membership Audit Log Action
      uses: svanboxel/org-audit-action@v1
      with:
        enterprise: 'goodcorp'
        token: ${{ secrets.TOKEN }}
        issue: true

Enterprise Audit triggered by an external service

Use a repository_dispatch event to trigger this workflow. The action in the following workflow is configured to:

• Work on an enterprise account
• Publish results also to an issue

on: repository_dispatch

jobs:

  audit_log:
    runs-on: ubuntu-latest
    name: Membership Audit Log

    - name: Membership Audit Log Action
      uses: svanboxel/org-audit-action@v1
      with:
        enterprise: 'goodcorp'
        token: ${{ secrets.TOKEN }}
        issue: true

Local testing

You can test this action locally by using the following command:

TOKEN=<github_token> ORGANIZATION=<organization name (or use ENTERPRISE=<enterprise_name>)> GITHUB_REPOSITORY=<owner>/<repository> node src/index.js

Help us improve it

Open an issue on: https://github.com/svanboxel/org-audit-action

org-audit-action's Issues

Audit log report for 2/27/2020, 8:58:17 AM

enterprise	organization	repo	user	login	permission

Audit Log Report Wed, 26 Feb 2020 09:03:15 GMT

sample_playload

Error in the generation of the export file

We have an error in the end of the script that blocks the generation of the export file :

  ⚛  Normalizing result.
  Uploading chunk of size 4194304 bytes at offset 0 with content range: bytes 0-4194303/4439402
  Uploading chunk of size 1898701 bytes at offset 0 with content range: bytes 0-1898700/1898701
  (node:1835) UnhandledPromiseRejectionWarning: Error: read ECONNRESET
      at TLSWrap.onStreamRead (internal/stream_base_commons.js:201:27)
  (node:1835) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 1)
  (node:1835) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.```

Audit Log Report Wed Feb 26 2020 09:56:35 GMT+0100 (Central European Standard Time)

sample_playload

Error: Parameter token or opts.auth is required

Receiving the error "Parameter token or opts.auth is required" when running an example configuration on a test organization and repo. Attached are the yaml file (renamed .txt for upload) and the action output.
err.log
main.yml.txt

Audit Log Report Wed, 26 Feb 2020 09:08:29 GMT

sample_playload

Audit log report for 2/27/2020, 8:48:24 AM

enterprise	organization	repo	user	login	permission

Audit Log Report Wed, 26 Feb 2020 09:07:28 GMT

sample_playload

Kick it off

Add pending member invites to the audit

Hi @SvanBoxel !

I was looking at https://docs.github.com/en/graphql/reference/objects#:~:text=to%20look%20for.-,pendingMemberInvitations,-(EnterprisePendingMemberInvitationConnection and i was wondering if this could be added as a query or added into an existing query (https://github.com/SvanBoxel/org-audit-action/blob/master/src/queries.js)? i otherwise don't have graphql experience but was curious if this would allow us to also see all pending invites and get true license counts.

Audit log report for 2/27/2020, 8:53:04 AM

enterprise	organization	repo	user	login	permission

Audit log report for 2/27/2020, 9:03:05 AM

enterprise	organization	repo	user	login	permission

Audit log report for 2/27/2020, 8:44:28 AM

enterprise	organization	repo	user	login	permission

Add Error Handle Logic - Failed Create Export Artifact

Thanks in advance for this nice action. Helps with compliance no doubt. I attempted to execute this against an enterprise cloud account with multiple organizations. It appears one of the Orgs does not contain and repositories to report against. As a result, it seems the action stops at that point and does not continue so that it can finish and generate the csv artifact. @SvanBoxel Here is the error message:

Start collecting for organization
⏸ No data found for , probably you don't have the right permission
Cannot read property 'samlIdentityProvider' of null
⚛ Normalizing result.
Uploading chunk of size 4194304 bytes at offset 0 with content range: bytes 0-4194303/5702770
Uploading chunk of size 2595943 bytes at offset 0 with content range: bytes 0-2595942/2595943
(node:1899) UnhandledPromiseRejectionWarning: Error: read ECONNRESET
at TLSWrap.onStreamRead (internal/stream_base_commons.js:201:27)
(node:1899) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 1)
(node:1899) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.

Audit log report for 2/27/2020, 9:04:13 AM

enterprise	organization	repo	user	login	permission