Reference A: Shared Cortex GitHub App permissions

This reference lists the GitHub App permissions the shared Cortex GitHub App requests. Palo Alto Networks owns and maintains the shared Cortex GitHub App, so these permissions are fixed and cannot be modified per tenant.

Permission	Access	Purpose
actions	Read	Scan GitHub Actions configurations
actions_variables	Read	Read repository-level Actions variables
administration	Read	Read repository metadata, branch protection, and team access
checks	Write	Report scan results as check runs on pull requests
contents	Write	Read source code for scanning and commit fix pull request suggestions
deployments	Read	Read deployment information for supply chain visibility
discussions	Read	Read discussions for context during scans
issues	Write	Create issues for scan findings
metadata	Read	Basic repository discovery (auto-granted)
packages	Read	Read package information for SCA dependency analysis
pull_requests	Write	Post scan result comments and reviews on pull requests, and create fix pull requests
repository_hooks	Write	Read webhook configuration for pull request scan triggers
secrets	Read	Read Actions secrets metadata for CI/CD security
secret_scanning_alerts	Read	Read secret scanning alerts
security_events	Read	Read code scanning (SARIF) alerts
statuses	Write	Set commit status checks (scan pass or fail)
vulnerability_alerts	Read	Read Dependabot alerts for SCA enrichment