github-archive

What problem does it solve?

Investigators often struggle to verify GitHub activity claims and reconstruct timelines when direct sources are incomplete or deleted. This skill provides access to tamper-proof GitHub Archive data via BigQuery to establish an immutable, time-stamped record of public GitHub events since 2011. It enables you to confirm actions, attribute events to actors, and recover deleted content across repositories.

Core Features & Use Cases

• Immutable evidence: All public events since 2011 are captured in the archive and queryable via BigQuery.
• Timeline reconstruction: Verify claims about PRs, issues, commits, and repository activity across multiple repositories.
• Content recovery: Reconstruct deleted PRs, issues, branches, tags, and repositories; attribute actions to actors with exact timestamps.
• Cross-repository analysis: Compare activity across organizations to identify patterns and attacker behavior.
• Use Case: Reconstruct a security incident timeline by querying PR and issue events and correlating with push and workflow events.

Quick Start

Use this skill to verify a claim about repository activity by querying GitHub Archive data for a target repository and actor, then analyze PullRequestEvent, IssuesEvent, and related events to build a timeline.