docs: document PAT-based GitHub repository connection

.spellcheck.yml

@@ -16,5 +16,5 @@ matrix:
       - code
       - pre
   sources:
-  - '**/*.md'
+  - '**/*.md|!node_modules/**|!build/**'
   default_encoding: utf-8

.wordlist.txt

@@ -569,4 +569,5 @@ ClusterRoles
 CentOS
 RHEL
 OpenSearch
-datetime
+datetime
+schemas

docs/admin-guide/notifications/webhook-payload-schema.md

@@ -25,7 +25,7 @@ For Generic Webhook notifications, the service also sends:
 - `X-Torque-EventType`: Same value as `EventType`
 - `X-Torque-Token`: Included only when a token is configured
 
-## EventData Schemas by EventType
+## `EventData` Schemas by `EventType`
 
 ## 1) Environment Lifecycle/Action Events
 

docs/admin-guide/source-control/source-control-github.md

@@ -3,12 +3,14 @@ sidebar_position: 1
 title: GitHub Source Control
 ---
 
-Torque supports connecting asset/blueprint repositories on GitHub out of the box. However, to connect a repository, you must have access to the repository and grant Torque permission to the repository's organization, as explained below. For details about connecting a repository, see [Discover Your Assets](/getting-started/asset-discovery). You should be able to sign in with an account on any one of these online services and immediately get going with connecting asset repositories and launching environments.
+Torque supports connecting asset/blueprint repositories on GitHub out of the box. However, to connect a repository, you must have access to the repository and grant Torque permission to the repository using a PAT (Personal Access Token), as explained below. For details about adding your assets to Torque, see [Discover Your Assets](/getting-started/asset-discovery). You should be able to sign in with an account on any one of these online services and immediately get going by connecting asset repositories and launching environments.
 
 **In this article:**
 - [Ensure your account is added to the GitHub organization you're connecting](#ensure-your-account-is-added-to-the-github-organization-youre-connecting)
-- [Ensure your organization has granted access to Torque](#ensure-your-organization-has-granted-access-to-torque)
+- [What is a Personal Access Token?](#what-is-a-personal-access-token)
+- [Connect a repository using a Personal Access Token](#connect-a-repository-using-a-personal-access-token)
 - [Token expiration and revocation](#token-expiration-and-revocation)
+<!-- - [Ensure your organization has granted access to Torque](#ensure-your-organization-has-granted-access-to-torque) -->
 
 **This article refers to the SAAS version of GitHub (github.com). If you're using self hosted GitHub Enterprise, check [here](/admin-guide/source-control/Self%20Hosted%20Repositories/overview)**.
 
@@ -18,7 +20,39 @@ Torque supports connecting asset/blueprint repositories on GitHub out of the box
 1. Go to [https://github.com/orgs/\{YOUR_ORG\}/people](https://github.com/orgs/\{YOUR_ORG\}/people).
 2. Make sure your user is listed in the organization. If not, make sure the user is added as a member with global read access.
 
-## Ensure your organization has granted access to Torque
+## What is a Personal Access Token?
+
+A Personal Access Token (PAT) is a credential you generate on GitHub that Torque uses in place of a password to authenticate and access your repositories. GitHub offers two types of PAT:
+
+- __Classic tokens__ — grant access based on broad, predefined scopes (e.g., `repo`, `read:org`).
+- __Fine-grained tokens__ — grant access to specific repositories with more granular permissions, offering tighter control over what Torque can access.
+
+Either type works with Torque. For instructions on generating one, see GitHub's [Managing your personal access tokens](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens) documentation.
+
+## Connect a repository using a Personal Access Token
+
+Torque connects to GitHub using a Personal Access Token (PAT). Both classic and fine-grained tokens are supported.
+
+1. In Torque, go to the space's __Settings > Repositories__ area and click __Add a Repository__.
+   > ![Add a Repository](/img/torque-repository.png)
+2. Select __GitHub__ as the repository provider.
+   > ![Select a repository provider](/img/torque-pat-github-provider.png)
+3. Fill in the __Repository URL__, __Repository Name__, and optionally a __Branch__.
+4. Under __Credentials__, start typing to create a new credential set, or select an existing one from the list.
+   > ![Connection details and credentials](/img/torque-pat-github-connection.png)
+5. Give the new credential set a name, then enter your __Personal Access Token__ in the field that appears.
+   > ![Enter your Personal Access Token](/img/torque-pat-github-token.png)
+   :::info
+   Click the __Auto-Track Environment Files__ option if you want to automatically discover and track Environment Files from this repository.
+   :::
+6. Leave __Self Managed Repository__ unchecked — that option is only for self-hosted GitHub Enterprise. See [Self-Managed GitHub](/admin-guide/source-control/Self%20Hosted%20Repositories/self-managed-github) for that flow.
+7. Click __Connect__.
+
+<!-- :::info TODO
+Document the required token scopes/permissions for classic vs. fine-grained PAT once confirmed.
+::: -->
+
+<!-- ## Ensure your organization has granted access to Torque
 
 When connecting a repository, Torque installs an OAuth app called __Torque Control Plane__ on the organization. This app provides Torque with the necessary permissions to the organization's repositories. If Torque doesn't have access, you will be prompted to grant the proper authorizations when connecting the asset repository. The approved applications are listed in the [GitHub Applications](https://github.com/settings/applications) page. 
 
@@ -37,7 +71,7 @@ When connecting a repository, Torque installs an OAuth app called __Torque Contr
      > ![Locale Dropdown](/img/request-org-access.png)
 
   The Torque app is granted the necessary permissions and the repository is connected.
-  6. Return to Torque and continue setting up the connection.
+  6. Return to Torque and continue setting up the connection. -->
 
 ## Token expiration and revocation
 

docs/blueprint-designer-guide/blueprint-quickstart-guide.md

@@ -85,7 +85,7 @@ As mentioned above, there are two types of blueprints, auto-generated blueprints
 ## Example multi-grain blueprint 1: Helm Application with MySQL and S3 Deployed by Terraform
 This blueprint is available in the __Sample__ space [here](https://portal.qtorque.io/Sample/blueprints/[Sample]Helm%20Application%20with%20MySql%20and%20S3%20Deployed%20by%20Terraform), which deploys 2 Terraform modules and a Helm chart:
 
-```yaml title=
+```yaml
 spec_version: 2
 description: Robotshop microservices application deployed on K8S with Helm and RDS deployed with TF
 

docs/blueprint-designer-guide/blueprints/shell-grain.md

@@ -442,7 +442,7 @@ You can specify the code to be run as free text bash/python3 commands or by refe
 
 To run a file, specify the file and its repo in the `files` section and the file name and extension under `commands`. For example, file "post-install-script.sh":
 
-```yaml title=
+```yaml
 grains:
   validate:
     kind: shell

docs/governance/audit-log/audit-log-json-example.md

@@ -4,7 +4,7 @@ title: Audit Log Event Examples
 ---
 
 ## Environment Termination Started
-```jsx title=
+```jsx
 inputs:
   {
     "_index": "quali",
@@ -38,7 +38,7 @@ inputs:
 
 ## Modify Space
 
-```jsx title=
+```jsx
 {
   "_index": "quali",
   "_type": "_doc",
@@ -71,7 +71,7 @@ inputs:
 
 ## Send User Invitation
 
-```jsx title=
+```jsx
 {
   "_index": "quali",
   "_type": "_doc",

docs/governance/audit-log/audit-log-overview.md

@@ -5,7 +5,7 @@ title: Audit Log Overview
 
 Torque provides integration with Elastic Stack, allowing you to easily monitor and audit your system users' behavior, investigate and remove security risks and vulnerabilities, and more. Once integrated, Torque begins capturing events and streams them to Elastic Stack for analytic data, allowing you to gain visibility into key platform events within your account, identify the most active policies, significant changes in resource operations, or filter actions by user and space.
 
-```jsx title=
+```jsx
 inputs:
   {
     "_index": "quali",

docs/torque-agent/Install-and-connect-self-hosted-agent.md

@@ -49,7 +49,7 @@ title: Install an Agent on your Kubernetes Cluster
 3. Click __Next__. 
 4. Click __Generate__ and copy the command that is displayed
 5. Paste the command in your command-line window to deploy the agent to your cluster. For example:     
-    ```jsx title=
+    ```jsx
     kubectl apply -f https://portal.qtorque.io/api/settings/executionhosts/deployment/k***roi/deployment.yaml
     ```
 5. A __Connected!__ status is displayed in Torque, indicating that the agent was successfully installed and can communicate with Torque. 

docs/torque-agent/service-accounts-for-azure.md

@@ -163,7 +163,7 @@ There are 2 ways to accomplish this:
 2. You may override the default credentials defined for the AKS agent, or define the credentials if no credentials were configured as the default.
 
     a. In the Terraform grain, specify the service-account name under spec > agent:
-      ```yaml title=
+      ```yaml
       spec:
         source:
           ...
@@ -175,7 +175,7 @@ There are 2 ways to accomplish this:
 
     b. Under `env-vars`, add the following (will override the default definition of the AKS agent):
 
-          ```jsx title=
+          ```jsx
           ARM_SUBSCRIPTION_ID: <Subscription_ID>
           ARM_TENANT_ID: <Tenant_ID>
           ARM_CLIENT_ID: <Client_ID>