Temper

^{GitHub App that hardens repositories to organizational standards}

A Probot v14 GitHub App that automatically configures repositories to match organization standards. It enforces merge settings, branch protection rules, issue labels, PR/issue templates, CODEOWNERS, Dependabot configuration, signed-commit merge strategies, and AI-powered PR reviews — across every repository in your GitHub organization.

Note

Part of the PulseEngine toolchain. Enforces PulseEngine organizational standards across all repositories.

Features

• Auto-configure new repositories — applies full configuration on repository.created events
• Branch protection — enforces required reviews, status checks, signed commits, and linear history
• Issue labels — synchronizes a standard label set (create, update, delete) across all repos
• PR and issue templates — pushes PR templates, issue templates, and CODEOWNERS into target repos
• Dependabot configuration — applies dependabot.yml and fixes missing PR labels
• Signed-commit merge strategy — temporarily enables merge commits to preserve GPG signatures, then auto-reverts
• AI-powered PR review — sends diffs to a local OpenAI-compatible endpoint with smart file prioritization (source code first, lockfiles/generated files excluded) and stale review superseding on force-push
• Auto-merge for bots — automatically enables auto-merge on Dependabot and configured bot PRs
• Organization-wide sync — bulk-apply configuration to every repo in the org
• ChatOps commands — 9 slash commands for on-demand configuration and diagnostics
• Fork-aware settings — separate merge and branch-protection overrides for forked repositories
• PR-based changes — optionally applies file changes via pull requests instead of direct commits
• Idempotent webhook processing — deduplicates delivery IDs to prevent duplicate work
• Retry with backoff — exponential backoff with jitter for transient GitHub API errors

Dashboard

Temper includes a built-in operations dashboard for monitoring compliance and activity across your organization. The dashboard provides:

• Organization-wide compliance score with per-repo breakdown
• Repository health cards — branch protection, signed commits, CI status, merge settings, labels
• Active pull request tracker with check status, labels, and age
• Signal feed for real-time webhook events and configuration drift

Access the dashboard at /dashboard when running with the standalone HTTP handler.

Quick Start

1. Register a GitHub App at https://github.com/settings/apps/new with repository (Contents, Issues, Pull Requests, Metadata) and organization (Members, Metadata) permissions. Subscribe to repository, issue_comment, and pull_request events.

2. Clone and bootstrap:

   git clone https://github.com/pulseengine/temper.git
   cd temper
   npm install
   npm run setup # interactive wizard to configure org, username, email

   Or non-interactively:

   npm run setup -- --org myorg --user myuser --email me@example.com

3. Configure environment variables:

   cp .env.example .env
   # Edit .env with your GitHub App credentials (APP_ID, PRIVATE_KEY, WEBHOOK_SECRET)

4. Run:

   npm start # production
   npm run dev # development (auto-reload via nodemon)

   The server listens on port 3000 (configurable via PORT) and exposes POST /api/github/webhooks, GET /health, and GET /webhook.

ChatOps Commands

Comment on any issue or pull request to trigger a command. The commenter must be an organization member.

Command	Description
/configure-repo	Apply full repository configuration (merge settings, branch protection, labels, templates, Dependabot)
/sync-all-repos	Synchronize configuration across all repositories in the organization
/check-config	Generate a configuration report for the current repository
/check-dependabot	Check Dependabot configuration and PR label compliance
/fix-dependabot-labels	Add missing labels to open Dependabot PRs
/analyze-org	Generate a full organization analysis report (creates a new issue)
/check-merge-strategy	Analyze a PR's merge strategy and signed-commit status
/allow-merge-commit	Temporarily enable merge commits for signed-commit preservation (admin-only, auto-reverts after timeout)
/review-pr	Trigger an AI-powered code review (requires ai_review.enabled: true; PR only)

Configuration

All behavior is controlled by config.yml. Key sections:

Section	Purpose
organization	Target GitHub organization
settings.merge	Default merge strategy (rebase-only by default)
forks.merge	Overridden merge settings for forked repos
branch_protection	Branch protection rules and fork overrides
issue_labels	Standard labels to synchronize
pull_request_rules	Required reviews, status checks
signed_commit_strategy	Merge-commit override for signed commits
dependabot	Dependabot v2 configuration to push to repos
change_strategy	PR-based vs. direct-commit change application
templates / codeowners	PR/issue templates and CODEOWNERS paths
ai_review	AI review endpoint, model, prompt, and limits
auto_merge	Auto-merge rules for Dependabot and bot PRs

See the file itself for the full schema and defaults.

Development

See DEVELOPMENT.md for the full development guide.

Deployment

• Docker — npm run docker:build builds the multi-stage Alpine image; push and run via your registry/orchestrator of choice.
• PM2 — production runs under PM2 (pm2 start npm --name temper -- start); self-update is wired so a push to main redeploys via the binary in tools/self-update/.
• Netcup VPS — current production target. Single host, 3.8 GB RAM, no swap; see verify-netcup-deployment.sh for the post-install checks.

License

MIT

---

_{Part of PulseEngine — formally verified WebAssembly toolchain for safety-critical systems}