GitHub (OpenConnector)
Read-only GitHub collector — repositories, activity, search, and the security surface (Dependabot / secret-scanning / code-scanning alerts, branch protection & rulesets, org members & 2FA, deploy keys / webhooks / Actions settings) — as a GitHub account connected centrally in FloMorphic → Connect (OpenConnector / oomol). Holds no GitHub token; uses oomol's curated actions plus its provider proxy over the flomorphic.svc.oc.* NATS subjects. The catalog's first Python -oc plugin.
- SDK
- Python
- Protocol
inflowv1- Actions
- 13
- Version
- v0.1.0
- Author
- FloMorphic
- Runs on
- flomorphic — needs Connect / OpenConnector proxy
- Categories
- DevOps and infrastructure
Reach for it when
Read-only GitHub — repositories, activity, and the security surface — without the plugin holding a token.
The use people don't expect
The security half is the part people miss: Dependabot, secret-scanning and code-scanning alerts, branch protection, org members and 2FA, deploy keys and webhooks. Thirteen actions that make your GitHub posture something a flow can ask about on a schedule.
A flow that uses it
Each one is a shape of flow, not a template to copy. Node names are the labels as they appear on the canvas; a name with a slash means either would do.
Posture sweep nobody has to remember to run
Starts withWeekly.
- GitHub (OpenConnector)
Reads branch protection, rulesets, org 2FA, deploy keys and webhooks across the org.
- Code
Compares against the policy you actually wrote down.
- POSTGRES
Records the result, so "we fixed that" has a date attached.
- JIRA
A ticket per repo that drifted.
What you getEvidence for the audit accumulates as the sweep runs instead of being reconstructed from screenshots the week before. The credential lives in FloMorphic → Connect; the plugin never sees it.
The reference, not the pitch
This page is about what the plugin is for. Every action, every connection field, the ports, the install one-liner and the caveats are in the catalog entry, which is the thing the maintainer updates.
Near it in the catalog
Jira as a participant in the process rather than the place work gets copied into afterwards.
NUCLEINucleiTemplate-based vulnerability scanning inside a flow, with templates chosen by filter rather than one at a time.
SCRAPLIScrapliNetwork devices over SSH or Telnet — Cisco, Arista, Juniper — with optional TextFSM parsing.