Last year when I looked into this there was no automated way to get this info; the normal audit log mentioned below does not contain any info about actions from

Last year when I looked into this there was no automated way to get this info; the normal audit log mentioned below does not contain any info about actions from oauth-ed applications afaik. If you email GitHub support they can pull out detailed logs from oauth app interactions from their internal tools. I would expect the GH security team to have relevant queries ready by now, maybe even do some proactive queries and start alerting anyone who had suspicious activity. (But this is just how I'd do it I have no special insight if they are doing this or something else).