GitHub App configuration

The GitHub App is Tasuku's external identity and trust anchor. It supplies signed webhooks, installation access, OAuth, reactions, reviews, issue comments, and pull request publication.

Stored fields

Tasuku stores the App and client identifiers plus encrypted client secret, webhook secret, and private key. These credentials come from the manifest conversion; Tasuku does not read GITHUB_APP_* environment variables.

Manifest URLs

TASUKU_PUBLIC_URL determines the webhook and OAuth callback URLs embedded in the manifest. Use the final stable HTTPS origin before installing the production App.

Permissions

Current workflows require email-address read access plus read/write contents, issues, and pull requests. Existing Apps must add email read permission and be reauthorized for signup to work.

Command handle

The App slug determines the bot handle used in issues and pull requests. Rename effects are therefore operational: users must mention the current GitHub handle.

Reconfiguration authority

The bootstrap token can authorize initial manifest registration only before the first user exists. After bootstrap, an active SUPER_USER is required to reconfigure the App.

Repository selection

GitHub installation selection controls which repositories Tasuku can discover. Tasuku's own enabled flag is an additional gate. A repository must be both GitHub-accessible and explicitly enabled in Tasuku before work can run.