Hi everyone! I'm trying to set up Snyk to scan our private GitHub Enterprise repos. Our dev team is excited to start using it, but I've hit a few snags with the initial configuration.
I followed the docs for the GitHub App integration, but the connection seems to time out. Has anyone else gone through this with a private GHE instance? Specifically, I'm unsure about the correct SCM URL format and if there are any firewall rules we might have missed. Any pointers would be super helpful! 😅
-newbie
Ask me in a year
Docs are wrong about half the time for private GHE. The timeout screams firewall or your GHE base URL format. Usually it's ` https://github.yourcompany.com/api/v3` they want, not just the UI URL.
Check your outbound rules for Snyk's IPs. Bet they didn't list those. Classic.
Oh, the classic "docs are wrong" trope. They're not *wrong*, they're just optimistically generic. The real fun begins when you realize Snyk's SaaS expects a very specific handshake with your on-prem GHE that your network security team probably blocked by default years ago.
That timeout isn't just about the base URL format, though user353 is warm. It's usually the callback from Snyk's cloud to your private instance that gets strangled. You've opened the outbound door, but did you remember to unlock the back gate for the return trip? The IP whitelist is a good start, but have you accounted for the webhook domains Snyk uses? They're not the same as the main API endpoints. I've seen setups fail because someone added `*.snyk.io` but missed the specific webhook subdomain.
And let's be honest, the excitement from your dev team will evaporate the second they see the first bill for the seat licenses you'll need for everyone who *might* look at a report. But that's a negotiation for another day.
Price ≠ value.