https://blog.heroku.com/github-integration-update

Skip Navigation Show nav
Heroku

  * Products
      + Heroku Platform
          o Heroku DX
              # Heroku Flow
              # Continuous Delivery
              # Continuous Integration
          o Heroku OpEx
          o Heroku Runtime
              # Heroku Dynos
      + Heroku Data Services
          o Heroku Postgres
          o Heroku Redis
          o Apache Kafka on Heroku
      + Heroku Enterprise
          o Heroku Private Spaces
          o Heroku Connect
          o Heroku Shield
      + Heroku Teams
  * Marketplace
      + Add-ons
      + Buttons
      + Buildpacks
      + About
  * Pricing
  * Documentation
  * Support
  * More
    Resources
      + What is Heroku?
      + Help
      + Customers
      + Careers
      + Events
      + Podcasts
      + Compliance Center
    Heroku is for
      + Developers
      + CTOs
      + Team Collaboration
      + Startups
      + Enterprises
      + Agencies
      + Students
      + See More
    Languages
      + Node
      + Ruby
      + Java
      + PHP
      + Python
      + Go
      + Scala
      + Clojure
      + See More
    Latest News from the Heroku Blog

    Heroku Blog

    Find out what's new with Heroku on our blog.

    More news View all blog posts

  * Search: [                    ]
  * Log in or Sign up

Heroku Blog

  * Latest
  * News
  * Engineering
  * Ecosystem
  * Life

  * Blog
  * News
  * Plans to Re-enable the GitHub Integration

|||

Video Transcript

X

Close

Plans to Re-enable the GitHub Integration

Shyam Subramanyan, Director, Product Management
Posted by Shyam Subramanyan, Director, Product Management and Vish
Abrams, Software Engineering Principal Architect, Heroku May 19, 2022
---------------------------------------------------------------------

Listen to this article

[Update: May 25, 2022] GitHub integration is now re-enabled. You can
connect to GitHub immediately or wait for the enhanced integration as
described below. To re-establish your GitHub connection now, please
follow these instructions.

We know you are waiting for us to re-enable our integration with
GitHub, and we've committed to you that we would only do so following
a security review. We are happy to report that the review has now
been completed.

One of the areas of focus was a review of the scope of tokens we
request from GitHub and store on your behalf. Currently, when you
authenticate with GitHub using OAuth, we request repo scope. The repo
scope gives us the necessary permissions to connect a Heroku pipeline
to your repo of choice and also allows us to monitor your repos for
commits and pull requests. It also enables us to write commit status
and deploy status to your repo on GitHub. As GitHub OAuth integration
is designed, it provides us with greater access than we need to get
the integration working.

In an effort to improve the security model of the integration, we are
exploring additional enhancements in partnership with GitHub, which
include moving to GitHub Apps for more granular permissions and
enabling RFC8705 for better protection of OAuth tokens. As these
enhancements require changes by both Heroku and GitHub, we will post
more information as the engagement evolves.

Meanwhile, we are working quickly to re-enable the integration after
running through a detailed checklist with the current permissions in
place. Once the integration is re-enabled, you will be able to
reconnect with GitHub and restore the Heroku pipeline functionality,
including review apps, with newly generated tokens. We will be
turning the integration back on next week and will notify you via a 
Heroku status post when it is available again for use.

When we re-enable the integration next week, you will be able to
re-connect to GitHub or choose to wait for us to improve on our
integration with GitHub as described earlier. The choice is yours.
Either way, we recommend git push heroku to keep your services up and
running until you choose to re-connect with GitHub on Heroku.

Thank you for your patience. We are as excited as you are to
re-enable the GitHub integration as we know you are eager to start
using it again.

GitHub incident response incident

  * Tweet
  * Share
  * Share

Related posts
---------------------------------------------------------------------

  * Incident Response at Heroku
  * How I Broke `git push heroku main`
  * Six Strategies for Deploying to Heroku
  * Heroku Postgres Update: Configuration, Credentials, and CI
  * Retrospectives

Browse the archives for news or all blogs Subscribe to the RSS feed
for news or all blogs.

Products

  * Heroku Platform
  * Heroku Data Services
  * Heroku Postgres
  * Heroku Redis
  * Apache Kafka on Heroku
  * Heroku Enterprise
  * Heroku Private Spaces
  * Heroku Connect
  * Heroku Shield
  * Heroku Teams
  * Elements Marketplace
  * Pricing

Resources

  * Documentation
  * Compliance Center
  * Training & Education
  * Blog
  * Podcasts
  * Get Started

About

  * About Us
  * What is Heroku
  * Heroku & Salesforce
  * Our Customers
  * Careers
  * Partners
  * Elements Marketplace

Support

  * Help Center
  * Status
  * Premium Support
  * Contact Us

Subscribe to our monthly newsletter

[                    ] Your email address: [                    ]
[Go]

  * RSS
      + Heroku Blog
      + Heroku News Blog
      + Heroku Engineering Blog
      + Dev Center Articles
      + Dev Center Changelog
      + Heroku Status
  * Podcasts
  * Twitter
      + Heroku
      + Dev Center Articles
      + Dev Center Changelog
      + Heroku Status
  * Facebook
  * Instagram
  * GitHub
  * LinkedIn
  * YouTube

Heroku is a company

  * heroku.com
  * Terms of Service
  * Privacy
  * Cookies
  * Cookie Preferences
  * (c) 2022 Salesforce.com