GitHub Token Revocation API Support by bowenaguero · Pull Request #43699 · demisto/content

bowenaguero · 2026-03-27T15:19:11Z

Adds support to the GitHub marketplace integration for the token revocation REST API endpoint. This is a newly introduced feature from GitHub.

Introduces a command that, when invoked with one or more valid GH access tokens as a provided argument, submits a revocation request to GitHub for the tokens.

Useful for IR scenarios where internal tokens have been leaked or exposed to the public and need immediate remediation.

Feature Release:
https://github.blog/changelog/2026-03-26-credential-revocation-api-now-supports-github-oauth-and-github-app-credentials/

Background:
https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation#token-revoked-by-a-third-party

API Docs:
https://docs.github.com/en/rest/credentials/revoke?apiVersion=2026-03-10

relates: https://jira-dc.paloaltonetworks.com/browse/CIAC-16393

content-bot · 2026-03-27T15:21:11Z

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @kamalq97 will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

content-bot · 2026-03-27T15:21:13Z

Hi @bowenaguero, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this link.

content-bot · 2026-03-27T15:21:14Z

🤖 AI-Powered Code Review Available

Hi @kamalq97, you can leverage AI-powered code review to assist with this PR!

Available Commands:

@marketplace-ai-reviewer start review - Initiate a full AI code review
@marketplace-ai-reviewer re-review - Incremental review for new commits

Copilot

Pull request overview

Adds support in the GitHub pack integration for GitHub’s credential (token) revocation REST endpoint, exposing it as a new XSOAR command intended for incident response use.

Changes:

Added github-revoke-credentials command implementation and command routing in the GitHub integration.
Added YAML command definitions (including legacy/deprecated alias) and unit tests for the new command.
Bumped pack version and added release notes for the new feature.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
Packs/GitHub/pack_metadata.json	Version bump to release the new feature.
Packs/GitHub/ReleaseNotes/2_3_0.md	Release note entry describing the new revoke-credentials command.
Packs/GitHub/Integrations/GitHub/GitHub_test.py	Added unit tests covering success and validation/error paths for token revocation.
Packs/GitHub/Integrations/GitHub/GitHub.yml	Added new command definitions (canonical + deprecated alias) and various argument formatting adjustments.
Packs/GitHub/Integrations/GitHub/GitHub.py	Implemented `github_revoke_credentials_command` and registered it in the commands map.

Comments suppressed due to low confidence (1)

Packs/GitHub/Integrations/GitHub/GitHub.yml:7268

In github-list-workflows, both workflow and limit are marked as isArray: true, but the code expects workflow to be a single workflow filename and casts limit to int. If these are provided as lists (as the YAML schema implies), the command will fail (e.g., int(list) TypeError) or generate invalid URLs. Adjust the argument schemas to match the implementation (non-array scalar values).

    - description: The name of your workflow file.
      name: workflow
      isArray: true
      required: true
    - description: The number of workflows to return. Default is 100.
      isArray: true
      name: limit

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-27T15:25:45Z

      isArray: true
+    - description: The name of your workflow file.
      name: workflow
+      isArray: true
      required: true
    - description: The number of workflows to return. Default is 100.
      isArray: true


In github-list-workflows, the repository argument is marked as isArray: true, but the implementation treats it as a single string when constructing the URL. This can cause invalid URLs if a list is passed. Update the YAML argument definition to not be an array (consistent with other workflow commands).

Suggested change

isArray: true

- description: The name of your workflow file.

name: workflow

isArray: true

required: true

- description: The number of workflows to return. Default is 100.

isArray: true

- description: The name of your workflow file.

name: workflow

required: true

- description: The number of workflows to return. Default is 100.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…ret"

marketplace-ai-reviewer · 2026-04-06T08:01:02Z

🤖 Analysis started. Please wait for results...

marketplace-ai-reviewer · 2026-04-06T08:16:01Z

🤖 AI Review Disclaimer

This review was generated by an AI-powered tool and may contain inaccuracies. Please be advised, and we extend our sincere apologies for any inconvenience this may cause.

marketplace-ai-reviewer

Thanks for your contribution to the GitHub pack! I've reviewed your changes and found a few minor issues to address. Please check the integration code for a potential AttributeError on successful API responses and ensure the ghs_ prefix is used for server-to-server tokens. Finally, make sure to add 'GitHub' to the keywords list in the pack metadata. Let me know if you have any questions!

Additionally, please address the following file-level notes:

Packs/GitHub/pack_metadata.json: The vendor name 'GitHub' must be included in the keywords list.

@barryyosi-panw, @copilot-pull-request-reviewer[bot] please review and approve the results generated by the AI Reviewer by responding 👍 on this comment.

barryyosi-panw · 2026-04-06T09:32:18Z

Please avoid unnecessary, cosmetic changes.

This is addressed in my most recent commit

CLAassistant · 2026-04-06T13:20:03Z

All committers have signed the CLA.

barryyosi-panw · 2026-04-08T13:04:51Z

Looks good to me!
Lets just wait for docs review to be completed.

content-bot · 2026-04-08T13:04:58Z

For the Reviewer: Trigger build request has been accepted for this contribution PR.

content-bot · 2026-04-08T13:05:06Z

For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/8137787

content-bot · 2026-04-08T13:12:49Z

Validate summary
The following errors were thrown as a part of this pr: RM110.
The following errors can be ignored: RM110.
If the AG100 validation in the pre-commit GitHub Action fails, the pull request cannot be force-merged.

Verdict: PR can be force merged from validate perspective? ❌

Co-authored-by: Richard Bluestone <53567272+richardbluestone@users.noreply.github.com>

github-actions · 2026-04-12T13:13:46Z

Thank you for your contribution. Your external PR has been merged and the changes are now included in an internal PR for further review. The internal PR will be merged to the master branch within 3 business days.

* GitHub Token Revocation API Support (#43699) * feat: Add github-revoke-credentials command for token revocation * update release notes and pack_metadata * Update release notes and formatting * Update Packs/GitHub/Integrations/GitHub/GitHub.py Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update Packs/GitHub/ReleaseNotes/2_3_0.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Changed version bump from minor to revision * Fix broken test * run pre-commit * Removed the unecessary deprecated command and made credentials a "secret" * Remove unnecessary cosmetic changes * Update Packs/GitHub/Integrations/GitHub/GitHub.yml Co-authored-by: Richard Bluestone <53567272+richardbluestone@users.noreply.github.com> * Update Packs/GitHub/ReleaseNotes/2_2_6.md Co-authored-by: Richard Bluestone <53567272+richardbluestone@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Richard Bluestone <53567272+richardbluestone@users.noreply.github.com> * Bump pack from version GitHub to 2.2.7. * Update README.md: Add GitHub credential revocation API endpoint and revoke �[K credentials command details --------- Co-authored-by: Bowen Aguero <127001006+bowenaguero@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Richard Bluestone <53567272+richardbluestone@users.noreply.github.com> Co-authored-by: Content Bot <bot@demisto.com> Co-authored-by: barryyosi-panw <byosilevich@paloaltonetworks.com>

* GitHub Token Revocation API Support (demisto#43699) * feat: Add github-revoke-credentials command for token revocation * update release notes and pack_metadata * Update release notes and formatting * Update Packs/GitHub/Integrations/GitHub/GitHub.py Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update Packs/GitHub/ReleaseNotes/2_3_0.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Changed version bump from minor to revision * Fix broken test * run pre-commit * Removed the unecessary deprecated command and made credentials a "secret" * Remove unnecessary cosmetic changes * Update Packs/GitHub/Integrations/GitHub/GitHub.yml Co-authored-by: Richard Bluestone <53567272+richardbluestone@users.noreply.github.com> * Update Packs/GitHub/ReleaseNotes/2_2_6.md Co-authored-by: Richard Bluestone <53567272+richardbluestone@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Richard Bluestone <53567272+richardbluestone@users.noreply.github.com> * Bump pack from version GitHub to 2.2.7. * Update README.md: Add GitHub credential revocation API endpoint and revoke �[K credentials command details --------- Co-authored-by: Bowen Aguero <127001006+bowenaguero@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Richard Bluestone <53567272+richardbluestone@users.noreply.github.com> Co-authored-by: Content Bot <bot@demisto.com> Co-authored-by: barryyosi-panw <byosilevich@paloaltonetworks.com>

bowenaguero added 3 commits March 27, 2026 14:58

feat: Add github-revoke-credentials command for token revocation

490611a

update release notes and pack_metadata

c24cd7d

Update release notes and formatting

64c20b4

Copilot AI review requested due to automatic review settings March 27, 2026 15:19

Copilot started reviewing on behalf of bowenaguero March 27, 2026 15:20 View session

content-bot added Contribution Thank you! Contributions are always welcome! External PR Xsoar Support Level Indicates that the contribution is for XSOAR supported pack labels Mar 27, 2026

content-bot changed the base branch from master to contrib/bowenaguero_master March 27, 2026 15:20

content-bot assigned kamalq97 Mar 27, 2026

content-bot requested a review from kamalq97 March 27, 2026 15:21

Copilot AI reviewed Mar 27, 2026

View reviewed changes

bowenaguero and others added 5 commits March 27, 2026 11:31

Update Packs/GitHub/Integrations/GitHub/GitHub.py

abcab3a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update Packs/GitHub/ReleaseNotes/2_3_0.md

4a5c70a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Changed version bump from minor to revision

815562e

Fix broken test

b732c59

run pre-commit

dcdac64

content-bot added Community Contribution Form Filled Whether contribution form filled or not. labels Mar 27, 2026

Removed the unecessary deprecated command and made credentials a "sec…

8a08f0c

…ret"

kamalq97 assigned barryyosi-panw and unassigned kamalq97 Mar 29, 2026

kamalq97 requested review from barryyosi-panw and removed request for kamalq97 March 29, 2026 10:43

barryyosi-panw added the ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. label Apr 6, 2026

marketplace-ai-reviewer removed the ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. label Apr 6, 2026

marketplace-ai-reviewer reviewed Apr 6, 2026

View reviewed changes

Comment thread Packs/GitHub/Integrations/GitHub/GitHub.py

Comment thread Packs/GitHub/Integrations/GitHub/GitHub.py

Comment thread Packs/GitHub/Integrations/GitHub/GitHub.py

barryyosi-panw reviewed Apr 6, 2026

View reviewed changes

Merge remote-tracking branch 'upstream/master'

5262193

bowenaguero requested a review from JudahSchwartz as a code owner April 6, 2026 13:19

Remove unnecessary cosmetic changes

75bc464

barryyosi-panw requested a review from richardbluestone April 8, 2026 13:03

barryyosi-panw added the ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. label Apr 8, 2026

barryyosi-panw approved these changes Apr 8, 2026

View reviewed changes

content-bot removed the ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. label Apr 8, 2026

richardbluestone reviewed Apr 9, 2026

View reviewed changes

Comment thread Packs/GitHub/Integrations/GitHub/GitHub.yml Outdated

richardbluestone reviewed Apr 9, 2026

View reviewed changes

Comment thread Packs/GitHub/ReleaseNotes/2_2_6.md Outdated

richardbluestone added the docs-approved label Apr 9, 2026

bowenaguero and others added 2 commits April 9, 2026 11:26

Update Packs/GitHub/Integrations/GitHub/GitHub.yml

02d148d

Co-authored-by: Richard Bluestone <53567272+richardbluestone@users.noreply.github.com>

Update Packs/GitHub/ReleaseNotes/2_2_6.md

8ab7c03

Co-authored-by: Richard Bluestone <53567272+richardbluestone@users.noreply.github.com>

barryyosi-panw merged commit 90c9918 into demisto:contrib/bowenaguero_master Apr 12, 2026
18 checks passed

content-bot mentioned this pull request Apr 12, 2026

GitHub Token Revocation API Support #43812

Merged

Conversation

bowenaguero commented Mar 27, 2026 • edited by marketplace-content-sync Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

content-bot commented Mar 27, 2026

Uh oh!

content-bot commented Mar 27, 2026

Uh oh!

content-bot commented Mar 27, 2026

🤖 AI-Powered Code Review Available

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

marketplace-ai-reviewer commented Apr 6, 2026

Uh oh!

marketplace-ai-reviewer commented Apr 6, 2026

Uh oh!

marketplace-ai-reviewer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

barryyosi-panw Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

bowenaguero Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

CLAassistant commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

barryyosi-panw commented Apr 8, 2026

Uh oh!

content-bot commented Apr 8, 2026

Uh oh!

content-bot commented Apr 8, 2026

Uh oh!

content-bot commented Apr 8, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

bowenaguero commented Mar 27, 2026 •

edited by marketplace-content-sync

Loading

CLAassistant commented Apr 6, 2026 •

edited

Loading