Skip to content

GH_Environment.md

Latest commit

 

History

History
63 lines (55 loc) · 3.08 KB

GH_Environment.md

File metadata and controls

63 lines (55 loc) · 3.08 KB
Raw

GH_Environment

General Information

Represents a GitHub Actions deployment environment configured on a repository. Environments can have protection rules including required reviewers, wait timers, administrator bypass behavior, and deployment branch policies.

Repositories always contain their environments. When custom branch policies are configured, the environment also contains one or more GH_EnvironmentBranchPolicy nodes that describe which branches are allowed to deploy. Environment-scoped secrets and variables are modeled as child nodes of the environment and become available to workflow jobs that reference it.

GH_CanRequestOIDCTokenFor edges from GH_WorkflowJob nodes identify jobs whose execution context can request a GitHub-signed OIDC token for this environment because their effective GITHUB_TOKEN permissions include id-token:write.

Properties

Property Type Description
name string The node name used for matching and display.
displayname string The human-readable display name.
environmentid string The identifier of the GitHub environment where this node was collected.
last_seen datetime The timestamp when this node was last observed during collection.
node_id string The stable identifier used as the OpenGraph node ID; this is the native GitHub node ID where available.
collected boolean Collected/generated by OpenHound.
short_name string The environment's display name (e.g., production, staging).
can_admins_bypass boolean Whether repository administrators can bypass environment protection rules.
wait_timer integer The wait timer value.
required_reviewers boolean The required reviewers value.
reviewer_count integer The reviewer count value.
prevent_self_review boolean The prevent self review value.
protected_branches boolean The protected branches value.
custom_branch_policies boolean The custom branch policies value.
repository_name string The full name of the containing repository.
repository_id string The ID of the containing repository.
environment_name string The name of the environment (GitHub organization).

Diagram

graph LR
    n0["GH_Branch"]
    n1["GH_Environment"]
    n2["GH_EnvironmentBranchPolicy"]
    n3["GH_EnvironmentSecret"]
    n4["GH_EnvironmentVariable"]
    n5["GH_RepoRole"]
    n6["GH_Repository"]
    n7["GH_Team"]
    n8["GH_User"]
    n9["GH_WorkflowJob"]
    n0 -->|GH_CanDeployToEnvironment| n1
    n1 -.->|GH_Contains| n2
    n1 -.->|GH_Contains| n3
    n1 -->|GH_HasSecret| n3
    n1 -.->|GH_Contains| n4
    n1 -->|GH_HasVariable| n4
    n5 -->|GH_CanDeployToEnvironment| n1
    n5 -->|GH_CanEditEnvironment| n1
    n6 -->|GH_CanDeployToEnvironment| n1
    n6 -.->|GH_Contains| n1
    n7 -.->|GH_ApprovesDeploymentTo| n1
    n7 -->|GH_CanDeployToEnvironment| n1
    n8 -.->|GH_ApprovesDeploymentTo| n1
    n8 -->|GH_CanDeployToEnvironment| n1
    n9 -.->|GH_DeploysTo| n1
    n9 -->|GH_CanRequestOIDCTokenFor| n1
Loading