GitHub Enterprise considerations

Before using Enterprise GitHub

Use this page before connecting a self-hosted GitHub Enterprise Server repository. Enterprise access has extra host, network, allowlist and callback checks that must be clear before WebRiskOps can safely index code or prepare review-only patches. Do not paste Enterprise tokens, private hostnames that should stay internal, VPN details or source snippets into documentation pages, external tickets or chat. Record only the product status fields and safe customer-facing reason.

Validate Enterprise connection

Follow the path `GitHub connection → Enterprise base URL → Network and allowlist check → Scope decision → Read-only indexing or fallback`.

1. Open /projects/{project}/repository-provider/github/connect and choose the Enterprise or self-hosted option. Result: deployment_mode and base_url are collected in the product flow instead of chat or tickets.
2. Enter the GitHub Enterprise Server base URL that the customer owns. Result: repository base URL validation can reject unsafe, public-mismatch or unsupported hosts.
3. Confirm private_network_policy and allowlist_status before continuing. Result: WebRiskOps knows whether callbacks, worker access or customer network controls block the connection.
4. Confirm the minimum repository access mode for read-only indexing or review-only patches. Result: the Enterprise connection does not request broader scopes than the workflow needs.
5. Check provider status after the connection attempt. Result: reachable host, callback state, installation and repository scope are visible before indexing starts.
6. Use fallback when connectivity, host validation or required scope is blocked. Result: ticket-only or customer-applied evidence can continue without unsafe self-hosted access.

Ready Enterprise states

Continue only when the product shows a ready or reviewable state.

• Enterprise host verified means base_url is accepted and belongs to the customer environment.
• Network allowed means private_network_policy and allowlist_status permit the product worker or callback route.
• Scope verified means the selected Enterprise repository grants only the access mode needed for indexing or review-only patches.
• Read-only ready means code indexing can start without branch, commit or pull request permissions.
• Fallback ready means the product has a safe ticket-only or customer-applied evidence path when Enterprise access cannot be used.

Blocked or unsafe states

Do not work around an unsafe access state. Use the product fallback or revoke path.

• Unreachable host means the customer network, firewall, DNS or allowlist blocks the Enterprise server.
• Invalid base URL means the host does not match an allowed GitHub Enterprise Server endpoint.
• Private network blocked means WebRiskOps cannot reach the server without a customer-approved connectivity path.
• Missing scopes means reconnect with the minimum required scope instead of expanding broadly.
• Callback blocked means installation or webhook confirmation cannot complete.
• Unsafe fallback request means do not ask for raw tokens, private keys or direct source uploads.

Continue from Enterprise setup

When Enterprise connection is ready, continue to Read-only indexing. If the environment differs from GitHub Cloud, keep Cloud and self-hosted distinctions nearby while deciding access mode and fallback. Use Self-hosted connectivity or Safe fallback paths when base_url, allowlist_status or private_network_policy blocks the connection.