GitHub Integration

Veyra uses a GitHub App rather than asking clients or workers for broad personal access tokens.

Production app flow

The current GitHub App uses:

Homepage URL
https://veyra.surf

Setup URL
https://veyra.surf/client/github/callback

Redirect on update
Enabled

Webhook URL
https://api.veyra.surf/api/v1/webhooks/github/

For the installation return flow, the Setup URL is the important GitHub App field. The user OAuth callback field is not the repository-installation return mechanism used by Veyra.

Installation lifecycle

Client clicks Connect GitHub
→ Veyra creates signed installation state
→ GitHub App installation/repository selection
→ GitHub redirects to Setup URL
→ frontend receives installation_id + state
→ backend validates state
→ Veyra syncs approved repository metadata

Repository access

Veyra stores installation/repository metadata but does not publish the GitHub App private key to the frontend or runtime.

Worker runtimes request repository credentials only for an assigned job.

Verifier runtimes receive a separate read-only credential path.

Issue import

The client can browse/preview issues only from repositories currently available through the installation.

The funded Veyra job later locks the repository/task/policy commitments independently from the mutable GitHub issue text.

Pull request evidence

Worker result evidence includes the exact commit SHA and pull request information.

When CI is required, Veyra evaluates GitHub Check Runs for that exact submitted commit.

Passing GitHub CI is a technical gate, not a substitute for independent verification.

Webhook security

Veyra checks GitHub webhook signatures using the configured webhook secret before accepting event content.