github-evidence-kit

To collect GitHub forensic evidence, you can identify and validate artifacts across the GitHub API, GH Archive, and local Git repositories. This process ensures structured JSON storage with schema validation and end-to-end verification against original sources.

GitHub forensic evidence supports commits, issues, pull requests, files, forks, and related artifacts. It also handles events like Push, Issue, and PR actions, alongside observations, IOCs, and external articles using a central EvidenceStore for re-verification.

Yes, GitHub forensic evidence collection works with local Git repositories, the GH Archive, and the GitHub API. It applies end-to-end verification to commits, issues, PRs, and files while preserving provenance through structured JSON storage.

Schema validation is needed for GitHub forensic evidence to ensure structured JSON storage remains consistent and reliable. It enforces data integrity across collected commits, issues, and PRs, enabling accurate re-verification against original sources.

The best way to preserve provenance during GitHub evidence collection is using a central EvidenceStore to load and verify forensic artifacts. This approach maintains source links for commits and PRs, enabling end-to-end re-verification against GitHub API and Git sources.

While the skill collects and verifies evidence from GitHub forks, commits, and files, it requires access to the GitHub API, GH Archive, or local Git sources. Re-verification depends on the continued availability and accessibility of these original upstream sources.