pthoor/fylgyr

Prerequisites:

• PowerShell 7+
• GitHub token for scans (for local runs, use a fine-grained Personal Access Token (PAT))
• Optional (only for provenance verification): GitHub CLI (gh)
• Windows install for GitHub CLI: winget install --id GitHub.cli --exact

# Install from PowerShell Gallery
Install-Module Fylgyr

# Provide a GitHub token (required for local runs, this is typically a fine-grained PAT)
$env:GITHUB_TOKEN = Read-Host -Prompt 'GitHub PAT' -MaskInput

# Scan a single repository
Invoke-Fylgyr -Owner 'myorg' -Repo 'myrepo'

# Scan all repositories in an organization
Invoke-Fylgyr -Owner 'myorg'

# Scan organization repositories + org-level policy controls (opt-in)
Invoke-Fylgyr -Owner 'myorg' -IncludeOrgChecks

# Optional cleanup
Remove-Item Env:GITHUB_TOKEN -ErrorAction SilentlyContinue

Why cleanup? Removing token variables after use reduces accidental exposure in later commands, logs, child processes, and shared terminal output.

Requires PowerShell 7+ and a GitHub token. For local runs, this is typically a fine-grained PAT. In GitHub Actions, the built-in GITHUB_TOKEN can run workflow-file checks. Fylgyr reads $env:GITHUB_TOKEN by default, or you can pass -Token explicitly:

# Preferred: load from SecretManagement (or your secret manager)
# and pass the token directly for this invocation
$token = Get-Secret -Name 'FYLGYR_PAT' -AsPlainText
Invoke-Fylgyr -Owner 'myorg' -Repo 'myrepo' -Token $token
Remove-Variable token -ErrorAction SilentlyContinue

# Fallback: masked interactive prompt
# $token = Read-Host -Prompt 'GitHub token' -MaskInput
# Invoke-Fylgyr -Owner 'myorg' -Repo 'myrepo' -Token $token

# Or pass a different token for a single call
Invoke-Fylgyr -Owner 'myorg' -Repo 'myrepo' -Token $otherToken

Fylgyr strongly recommends fine-grained PATs for default operation. Core repository checks and most organization checks work with least-privilege fine-grained permissions, and no feature requires a classic PAT. Some organization governance APIs (currently PAT policy evidence endpoints) can be restricted by GitHub to GitHub App token types; in those contexts Fylgyr reports advisory Info results instead of a misleading fail. Never hardcode tokens; load them from a secret manager.