GitHub
A hosted git service: repositories, pull requests with reviews, and branch rulesets that decide what may reach a branch. Things here that push objects out of an SAP system, or keep a review record outside it, call its API and open their pull requests on it.
Where it sits
Used by
Required dependency. The pull requests, the reviews and the branch ruleset that keeps the base branch to what has been released all live on GitHub, and each developer's token is issued by a GitHub App installed on the repositories.
Functional boundary
Not below SAP_BASIS 7.40 SP08, and not on [SAP S/4HANA Cloud Public Edition](external:sap-s4hana-cloud-public-edition) or [the SAP BTP ABAP environment](artifact:btp-abap-environment), where the classic transport check, the report and job calls and the cluster table `INDX` it rests on do not exist and the maintainer names gCTS as the answer instead. Only on a development system where every developer is trusted: each developer's GitHub token is kept in a cluster table encrypted with a key held in the same table, so anybody who can run ABAP on that system can read both, and the separation between author and reviewer holds only as far as that trust does. Not where the gate has to be unconditional — `#NOREVIEW` in a request's short text skips the check for that request, `ZTR_DISABLED` switches it off for a system, a check that cannot reach GitHub lets the release go on, and nothing checks who writes the marker.
Optionally used: the exercises are worked through in a GitHub Codespace rather than the local dev container the account a Codespace for the course exercises is created under
Optionally used: the environment is a GitHub Codespace rather than a container on your own machine the account the Codespace that hosts the environment is created under
Required dependency. The ATC check reads the object list from the repository's raw URL, so the system running the check needs SSL set up to reach git.
Functional boundary
It is a catalogue of SAP's objects and not a reading of your code: it states that an object is not released, never that you used it, and the finding is the ATC check's. For SAP Cloud ERP Private the files exist for feature pack stack releases only, with no update per support package, so a system between two stacks is checked against its stack's file.
Dependency relationship. where the template is copied and run: the repository secrets and variables hold the BTP credentials and the subaccount name and region, and the Terraform Deploy workflow runs in Actions.
Connected from
data, outbound. Reading the repositories' committed knowledge files into a per-user cache kept for a day, and listing the documentation's pages through the GitHub API.
Functional boundary
Every gate here runs off-system, so what the class does on a real system and what the view does on the oldest UI5 release it has to serve are what the `pitfalls` catalogues carry and no local run can see. It runs abap2UI5 app classes, so ABAP that is not one has nothing here to deploy into. In system mode the sandbox tools are not offered, and an `app_act` event runs on the system as the configured user.
data, outbound. Reads the JSON, XML or raw test data file the configuration object points at, so the data set a unit test runs on is maintained in a repository instead of in the ABAP system.
data, HTTP, outbound. Commits the objects of a released task to the branch review/<request>, opens the pull request for it, compares the objects of the request with that branch when the request is released, and squashes and merges the pull request into the base branch. The push, the pull request and the merge run as background jobs.
Functional boundary
Not below SAP_BASIS 7.40 SP08, and not on [SAP S/4HANA Cloud Public Edition](external:sap-s4hana-cloud-public-edition) or [the SAP BTP ABAP environment](artifact:btp-abap-environment), where the classic transport check, the report and job calls and the cluster table `INDX` it rests on do not exist and the maintainer names gCTS as the answer instead. Only on a development system where every developer is trusted: each developer's GitHub token is kept in a cluster table encrypted with a key held in the same table, so anybody who can run ABAP on that system can read both, and the separation between author and reviewer holds only as far as that trust does. Not where the gate has to be unconditional — `#NOREVIEW` in a request's short text skips the check for that request, `ZTR_DISABLED` switches it off for a system, a check that cannot reach GitHub lets the release go on, and nothing checks who writes the marker.
authentication, HTTP, outbound. Logs each developer in once through the device flow of the GitHub App and keeps the resulting token per SAP user, encrypted, so that every commit, pull request and merge is made under that developer's own account.
Functional boundary
Not below SAP_BASIS 7.40 SP08, and not on [SAP S/4HANA Cloud Public Edition](external:sap-s4hana-cloud-public-edition) or [the SAP BTP ABAP environment](artifact:btp-abap-environment), where the classic transport check, the report and job calls and the cluster table `INDX` it rests on do not exist and the maintainer names gCTS as the answer instead. Only on a development system where every developer is trusted: each developer's GitHub token is kept in a cluster table encrypted with a key held in the same table, so anybody who can run ABAP on that system can read both, and the separation between author and reviewer holds only as far as that trust does. Not where the gate has to be unconditional — `#NOREVIEW` in a request's short text skips the check for that request, `ZTR_DISABLED` switches it off for a system, a check that cannot reach GitHub lets the release go on, and nothing checks who writes the marker.
data, outbound. fetching ABAP that lives somewhere else: a ?src= link, a shared link or a catalogue row is opened by the raw URL of its class, and the hosts it will read from are this site and GitHub's raw hosts
Functional boundary
A `SELECT` from a business table has nothing to select from: the database in the page holds the framework's own tables, and nothing can reach outside the browser, so an app that reads a system's data cannot be tried here. Only the UI5 libraries built in are available and a control from anywhere else will not load; what the transpiler cannot compile is reported in the output panel rather than run. State lives in the tab — a reload, and a press of Run, starts over on a fresh database.
data, outbound. create-abap2ui5-app reads template.json and the files it names from the template's main branch while it runs, instead of carrying a file list of its own.
data, outbound. Reading the code templates that action parameterises and inserts into the source code, from the maintainer's abap-code-snippets repository.
data, outbound. Pulls the repositories listed in zdevsysinit_params from GitHub, over a connection the report prepares by installing the SSL certificates it needs.
Functional boundary
Not against a system holding local repository changes that have not been pushed: Pull Repos overwrites every repository named in zdevsysinit_params, which is why the maintainer leaves that box unticked and calls it a danger zone. The maintainer calls the whole report work in progress, to be used at own risk.
ActivityNo published releases; repository quiet for 24 months
authentication, outbound. Keeps the GitHub user and API token in an RFC destination named GITHUB that the report creates, and creates the user exit that lets abapGit Standalone reach private repositories with them.
Functional boundary
Not against a system holding local repository changes that have not been pushed: Pull Repos overwrites every repository named in zdevsysinit_params, which is why the maintainer leaves that box unticked and calls it a danger zone. The maintainer calls the whole report work in progress, to be used at own risk.
ActivityNo published releases; repository quiet for 24 months
Details
Graph
For your agent
- Ref
external:github- JSON
- /externals/github.json
- MCP
- Connecting an agent