Create the GitHub App

Tasuku uses a GitHub App for webhook identity, OAuth signup, repository access, reactions, reviews, issue comments, and approved pull request creation.

Register from the dashboard

During first-run setup, enter the GitHub owner login and open the manifest flow. Tasuku constructs the webhook URL, OAuth callback, permissions, and event subscriptions from TASUKU_PUBLIC_URL.

The equivalent route is:

GET /api/v1/github/app-manifest/register?organization_id=<organization-id>&owner=<github-owner>

The bootstrap token can authorize this route only before the first user exists. Later reconfiguration requires an active SUPER_USER.

Complete the GitHub flow

1. Review and create the App on GitHub.
2. Allow GitHub to return to Tasuku's manifest callback.
3. Install the App on the intended organization or account.
4. Select the repositories Tasuku may access.

GitHub returns the App ID, client secret, webhook secret, and private key. Tasuku stores identifiers in Postgres and encrypts credentials with TASUKU_MASTER_KEY.

Repository synchronization

Installation and repository events synchronize the selected repositories into Tasuku. Every accessible repository appears in the dashboard paused. An ADMIN or SUPER_USER must explicitly enable it before webhooks can enqueue or execute agent workflows.

Removing GitHub access makes the repository ineligible for new work. Pausing it in Tasuku has the same enqueue effect without changing the GitHub installation.

Existing GitHub Apps

An existing App must include Email addresses: read and be reauthorized. The first account becomes the super user without an email-domain check. Later signup checks verified email addresses returned by GitHub; without this permission, those signups fail with GITHUB_EMAIL_PERMISSION_REQUIRED.

Webhook guarantees

• Tasuku verifies the GitHub signature before persisting a delivery.
• GitHub delivery IDs are deduplicated.
• Event handlers create durable workflow state rather than running agents inside the webhook request.
• The configured App slug determines the command handle. If the slug is acme-reviewer, use @acme-reviewer, not a hard-coded Tasuku mention.

Next, enable a repository and run the first review.