[github] change API key variable to optional for security advisories data stream

packages/github/_dev/build/docs/README.md

@@ -113,7 +113,7 @@
 
 The GitHub Security Advisories datastream lets you retrieve reviewed and unreviewed global security advisories from the GitHub advisory database. Check [Working with security advisories](https://docs.github.com/en/code-security/security-advisories) for more details.
 
-To use this integration, you must [create a fine-grained personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-fine-grained-personal-access-token) (GitHub App user access tokens, GitHub App installation access tokens, Fine-grained personal access tokens). This fine-grained token does not require any permissions. 
+To use this integration, you may [create a fine-grained personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-fine-grained-personal-access-token) (GitHub App user access tokens, GitHub App installation access tokens, Fine-grained personal access tokens). This fine-grained token does not require any permissions. Authentication is not required when accessing data from public repositories, so you can leave the API key field blank in that case.
 
 {{fields "security_advisories"}}
 

packages/github/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.23.1"
+  changes:
+    - description: Change API key variable to optional for security advisories data stream, as authentication is not required for public repositories.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/18545
 - version: "2.23.0"
   changes:
     - description: Enable Agentless deployment.

packages/github/data_stream/security_advisories/agent/stream/cel.yml.hbs

@@ -6,7 +6,9 @@ resource.tracer:
   maxbackups: 5
 resource.url: {{api_url}}
 state:
+{{#if api_key}}
   api_key: {{api_key}}
+{{/if}}
   advisory_type: {{advisory_type}}
   batch_size: {{batch_size}}
 redact:
@@ -29,7 +31,7 @@ program: |-
     "Header": {
         "Accept": ["application/vnd.github+json"],
         "X-GitHub-Api-Version": ["2022-11-28"],
-        "Authorization": ["Bearer " + state.api_key],
+        ?"Authorization": has(state.api_key) && state.api_key != "" ? optional.ofNonZeroValue(["Bearer " + state.api_key]) : optional.ofNonZeroValue([]),
     },
   }).do_request().as(resp, (resp.StatusCode != 200) ?
     {
@@ -50,7 +52,7 @@ program: |-
   :
     bytes(resp.Body).decode_json().as(body,
       {
-        "api_key": state.api_key,
+        ?"api_key": state.?api_key,
         "advisory_type": state.advisory_type,
         "batch_size": state.batch_size,
         "cursor": {

packages/github/data_stream/security_advisories/manifest.yml

@@ -17,9 +17,9 @@ streams:
       - name: api_key
         type: password
         title: API key
-        description: API key for GitHub REST API. This Personal Access Token is used to authenticate with the GitHub REST API and should be kept secret.
+        description: The GitHub Personal Access Token (PAT) is used to authenticate with the GitHub REST API. You may leave this field blank for public repositories, as authentication is not required for them.
         multi: false
-        required: true
+        required: false
         show_user: true
         secret: true
       - name: advisory_type

packages/github/docs/README.md

@@ -1027,7 +1027,7 @@
 
 The GitHub Security Advisories datastream lets you retrieve reviewed and unreviewed global security advisories from the GitHub advisory database. Check [Working with security advisories](https://docs.github.com/en/code-security/security-advisories) for more details.
 
-To use this integration, you must [create a fine-grained personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-fine-grained-personal-access-token) (GitHub App user access tokens, GitHub App installation access tokens, Fine-grained personal access tokens). This fine-grained token does not require any permissions. 
+To use this integration, you may [create a fine-grained personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-fine-grained-personal-access-token) (GitHub App user access tokens, GitHub App installation access tokens, Fine-grained personal access tokens). This fine-grained token does not require any permissions. Authentication is not required when accessing data from public repositories, so you can leave the API key field blank in that case.
 
 **Exported fields**
 

packages/github/manifest.yml

@@ -1,6 +1,6 @@
 name: github
 title: GitHub
-version: "2.23.0"
+version: "2.23.1"
 description: Collect logs from GitHub with Elastic Agent.
 type: integration
 format_version: "3.4.0"