Core

GitHub Apps

Short-lived installation tokens, signed webhooks and deployment feedback.

Connect an installation

An operator registers an App under Sources → GitHub Apps through GitHub's manifest flow, or enters an existing App manually, including GitHub Enterprise Server. Each installation becomes a source. Private clones use repository-scoped, read-only tokens that live in memory for at most an hour; the App credentials are encrypted at rest.

Deploy and report back

Push and PR webhooks are signature-checked and deduplicated, then matched by repository ID so renames and transfers keep working.
The Deploy Wizard links new services to their selected App repository. Existing services can migrate, finalize or revert from Settings → GitHub. Migration keeps the PAT and webhook until finalization.
Opt in to commit statuses and a single updated preview comment per PR. Feedback failure never fails the deployment.
Private App clones on remote nodes require agent v0.13.0 or newer over sealed transport and Git ≥ 2.31. The panel checks capabilities before minting a per-job token.

ninedeploy github-app list
ninedeploy services github

# SDK: client.githubApps and client.services.github

The canonical guides live in the repository's GITHUB_APP.md.