feat(auth): github app#570

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
msukkari merged 9 commits into from
Oct 22, 2025
Merged

feat(auth): github app #570

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
fa8e0d2
properly handle emails for github app auth case
msukkari Oct 18, 2025
b96a35a
add docs info for auth through github app
msukkari Oct 18, 2025
d69851c
more info in docs for user auth perms
msukkari Oct 18, 2025
1360caa
modify review agent env var names
msukkari Oct 21, 2025
1cd9007
github app service auth
msukkari Oct 22, 2025
4af3b53
coderabbit suggestions
msukkari Oct 22, 2025
b0dc257
merge main
msukkari Oct 22, 2025
2d2d540
fixes
msukkari Oct 22, 2025
49f1f05
fix build
msukkari Oct 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions CHANGELOG.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added
- Implement dynamic tab titles for files and folders in browse tab. [#560](https://github.com/sourcebot-dev/sourcebot/pull/560)
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)
- Added support for GitHub Apps for service auth. [#570](https://github.com/sourcebot-dev/sourcebot/pull/570)

### Fixed
- Fixed "dubious ownership" errors when cloning / fetching repos. [#553](https://github.com/sourcebot-dev/sourcebot/pull/553)
Expand All@@ -27,9 +29,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Removed spam "login page loaded" log. [#552](https://github.com/sourcebot-dev/sourcebot/pull/552)
- Removed connections management page. [#563](https://github.com/sourcebot-dev/sourcebot/pull/563)

### Added
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)

## [4.7.3] - 2025-09-29

### Fixed
Expand Down
2 changes: 1 addition & 1 deletion docs/docs/configuration/auth/overview.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -10,7 +10,7 @@ Sourcebot's built-in authentication system gates your deployment, and allows adm
<Card horizontal title="Authentication providers" icon="lock" href="/docs/configuration/auth/providers">
Configure additional authentication providers for your deployment.
</Card>
<Card horizontal title="Inviting members" icon="user" href="/docs/configuration/auth/inviting-members">
<Card horizontal title="Access settings" icon="user" href="/docs/configuration/auth/access-settings">
Learn how to configure how members join your deployment.
</Card>
<Card horizontal title="Roles and permissions" icon="shield" href="/docs/configuration/auth/roles-and-permissions">
Expand Down
7 changes: 7 additions & 0 deletions docs/docs/configuration/auth/providers.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -33,6 +33,13 @@ The following authentication providers require an [enterprise license](/docs/lic

[Auth.js GitHub Provider Docs](https://authjs.dev/getting-started/providers/github)

Authentication using both a **GitHub OAuth App** and a **GitHub App** is supported. In both cases, you must provide Sourcebot the `CLIENT_ID` and `SECRET_ID` and configure the
callback URL correctly (more info in Auth.js docs).

When using a **GitHub App** for auth, enable the following permissions:
- `“Email addresses” account permissions (read)`
- `"Metadata" repository permissions (read)` (only needed if enabling [permission syncing](/docs/features/permission-syncing))

**Required environment variables:**
- `AUTH_EE_GITHUB_CLIENT_ID`
- `AUTH_EE_GITHUB_CLIENT_SECRET`
Expand Down
6 changes: 3 additions & 3 deletions docs/docs/configuration/environment-variables.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -62,9 +62,9 @@ The following environment variables allow you to configure your Sourcebot deploy
### Review Agent Environment Variables
| Variable | Default | Description |
| :------- | :------ | :---------- |
| `GITHUB_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
| `GITHUB_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
| `GITHUB_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
| `GITHUB_REVIEW_AGENT_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
| `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
| `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
| `OPENAI_API_KEY` | `-` | <p>The OpenAI API key used by the review agent.</p> |
| `REVIEW_AGENT_API_KEY` | `-` | <p>The Sourcebot API key used by the review agent.</p> |
| `REVIEW_AGENT_AUTO_REVIEW_ENABLED` | `false` | <p>Enables/disables automatic code reviews by the review agent.</p> |
Expand Down
12 changes: 6 additions & 6 deletions docs/docs/features/agents/review-agent.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -44,9 +44,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
<Step title="Configure the environment variables in Sourcebot">
Sourcebot requires the following environment variables to begin reviewing PRs through your new GitHub app:

- `GITHUB_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
- `GITHUB_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
- `GITHUB_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
- `GITHUB_REVIEW_AGENT_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
- `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
- `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
(ex `/data/review-agent-key.pem`). You must copy the private key file into the directory you mount to Sourcebot (similar to the config file).

You can generate a private key file for your app in the [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings). You must copy this private key file into the
Expand DownExpand Up@@ -74,9 +74,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
- "/Users/michael/sourcebot_review_agent_workspace:/data"
environment:
CONFIG_PATH: "/data/config.json"
GITHUB_APP_ID: "my-github-app-id"
GITHUB_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
GITHUB_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
GITHUB_REVIEW_AGENT_APP_ID: "my-github-app-id"
GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
REVIEW_AGENT_API_KEY: "sourcebot-my-key"
OPENAI_API_KEY: "sk-proj-my-open-api-key"
```
Expand Down
82 changes: 82 additions & 0 deletions docs/snippets/schemas/v3/app.schema.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
```json
{
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "AppConfig",
"oneOf": [
{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"title": "GithubAppConfig",
"properties": {
"type": {
"const": "githubApp",
"description": "GitHub App Configuration"
},
"deploymentHostname": {
"type": "string",
"format": "hostname",
"default": "github.com",
"description": "The hostname of the GitHub App deployment.",
"examples": [
"github.com",
"github.example.com"
]
},
"id": {
"type": "string",
"description": "The ID of the GitHub App."
},
"privateKey": {
"description": "The private key of the GitHub App.",
"anyOf": [
{
"type": "object",
"properties": {
"secret": {
"type": "string",
"description": "The name of the secret that contains the token."
}
},
"required": [
"secret"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"env": {
"type": "string",
"description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
}
},
"required": [
"env"
],
"additionalProperties": false
}
]
}
},
"required": [
"type",
"id"
],
"oneOf": [
{
"required": [
"privateKey"
]
},
{
"required": [
"privateKeyPath"
]
}
],
"additionalProperties": false
}
]
}
```
76 changes: 76 additions & 0 deletions docs/snippets/schemas/v3/githubApp.schema.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
```json
{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"title": "GithubAppConfig",
"properties": {
"type": {
"const": "githubApp",
"description": "GitHub App Configuration"
},
"deploymentHostname": {
"type": "string",
"format": "hostname",
"default": "github.com",
"description": "The hostname of the GitHub App deployment.",
"examples": [
"github.com",
"github.example.com"
]
},
"id": {
"type": "string",
"description": "The ID of the GitHub App."
},
"privateKey": {
"description": "The private key of the GitHub App.",
"anyOf": [
{
"type": "object",
"properties": {
"secret": {
"type": "string",
"description": "The name of the secret that contains the token."
}
},
"required": [
"secret"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"env": {
"type": "string",
"description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
}
},
"required": [
"env"
],
"additionalProperties": false
}
]
}
},
"required": [
"type",
"id"
],
"oneOf": [
{
"required": [
"privateKey"
]
},
{
"required": [
"privateKeyPath"
]
}
],
"additionalProperties": false
}
```
83 changes: 83 additions & 0 deletions docs/snippets/schemas/v3/index.schema.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -4273,6 +4273,89 @@
}
]
}
},
"apps": {
"type": "array",
"description": "Defines a collection of apps that are available to Sourcebot.",
"items": {
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "AppConfig",
"oneOf": [
{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"title": "GithubAppConfig",
"properties": {
"type": {
"const": "githubApp",
"description": "GitHub App Configuration"
},
"deploymentHostname": {
"type": "string",
"format": "hostname",
"default": "github.com",
"description": "The hostname of the GitHub App deployment.",
"examples": [
"github.com",
"github.example.com"
]
},
"id": {
"type": "string",
"description": "The ID of the GitHub App."
},
"privateKey": {
"anyOf": [
{
"type": "object",
"properties": {
"secret": {
"type": "string",
"description": "The name of the secret that contains the token."
}
},
"required": [
"secret"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"env": {
"type": "string",
"description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
}
},
"required": [
"env"
],
"additionalProperties": false
}
],
"description": "The private key of the GitHub App."
}
},
"required": [
"type",
"id"
],
"oneOf": [
{
"required": [
"privateKey"
]
},
{
"required": [
"privateKeyPath"
]
}
],
"additionalProperties": false
}
]
}
}
},
"additionalProperties": false
Expand Down
1 change: 1 addition & 0 deletions packages/backend/package.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -24,6 +24,7 @@
"dependencies": {
"@coderabbitai/bitbucket": "^1.1.3",
"@gitbeaker/rest": "^40.5.1",
"@octokit/app": "^16.1.1",
"@octokit/rest": "^21.0.2",
"@sentry/cli": "^2.42.2",
"@sentry/node": "^9.3.0",
Expand Down
Loading
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat(auth): github app#570

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

msukkari
merged 9 commits into

from

Oct 22, 2025
 Merged


feat(auth): github app
#570
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
fa8e0d2

properly handle emails for github app auth case


msukkari Oct 18, 2025
b96a35a

add docs info for auth through github app


msukkari Oct 18, 2025
d69851c

more info in docs for user auth perms


msukkari Oct 18, 2025
1360caa

modify review agent env var names


msukkari Oct 21, 2025
1cd9007

github app service auth


msukkari Oct 22, 2025
4af3b53

coderabbit suggestions


msukkari Oct 22, 2025
b0dc257

merge main


msukkari Oct 22, 2025
2d2d540

fixes


msukkari Oct 22, 2025
49f1f05

fix build


msukkari Oct 22, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 2 additions & 3 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added
- Implement dynamic tab titles for files and folders in browse tab. [#560](https://github.com/sourcebot-dev/sourcebot/pull/560)
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)
- Added support for GitHub Apps for service auth. [#570](https://github.com/sourcebot-dev/sourcebot/pull/570)

### Fixed
- Fixed "dubious ownership" errors when cloning / fetching repos. [#553](https://github.com/sourcebot-dev/sourcebot/pull/553)
Expand All@@ -27,9 +29,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Removed spam "login page loaded" log. [#552](https://github.com/sourcebot-dev/sourcebot/pull/552)
- Removed connections management page. [#563](https://github.com/sourcebot-dev/sourcebot/pull/563)

### Added
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)

## [4.7.3] - 2025-09-29

### Fixed
Expand Down

2 changes: 1 addition & 1 deletion
docs/docs/configuration/auth/overview.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -10,7 +10,7 @@ Sourcebot's built-in authentication system gates your deployment, and allows adm
 <Card horizontal title="Authentication providers" icon="lock" href="/docs/configuration/auth/providers">
 Configure additional authentication providers for your deployment.
 </Card>
 <Card horizontal title="Inviting members" icon="user" href="/docs/configuration/auth/inviting-members">
 <Card horizontal title="Access settings" icon="user" href="/docs/configuration/auth/access-settings">
 Learn how to configure how members join your deployment.
 </Card>
 <Card horizontal title="Roles and permissions" icon="shield" href="/docs/configuration/auth/roles-and-permissions">
Expand Down

7 changes: 7 additions & 0 deletions
docs/docs/configuration/auth/providers.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33,6 +33,13 @@ The following authentication providers require an [enterprise license](/docs/lic

[Auth.js GitHub Provider Docs](https://authjs.dev/getting-started/providers/github)

Authentication using both a **GitHub OAuth App** and a **GitHub App** is supported. In both cases, you must provide Sourcebot the `CLIENT_ID` and `SECRET_ID` and configure the 
callback URL correctly (more info in Auth.js docs). 

When using a **GitHub App** for auth, enable the following permissions:
- `“Email addresses” account permissions (read)`
- `"Metadata" repository permissions (read)` (only needed if enabling [permission syncing](/docs/features/permission-syncing))

**Required environment variables:**
- `AUTH_EE_GITHUB_CLIENT_ID`
- `AUTH_EE_GITHUB_CLIENT_SECRET`
Expand Down

6 changes: 3 additions & 3 deletions
docs/docs/configuration/environment-variables.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -62,9 +62,9 @@ The following environment variables allow you to configure your Sourcebot deploy
### Review Agent Environment Variables
| Variable | Default | Description |
| :------- | :------ | :---------- |
| `GITHUB_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
| `GITHUB_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
| `GITHUB_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
| `GITHUB_REVIEW_AGENT_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
| `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
| `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
| `OPENAI_API_KEY` | `-` | <p>The OpenAI API key used by the review agent.</p> |
| `REVIEW_AGENT_API_KEY` | `-` | <p>The Sourcebot API key used by the review agent.</p> |
| `REVIEW_AGENT_AUTO_REVIEW_ENABLED` | `false` | <p>Enables/disables automatic code reviews by the review agent.</p> |
Expand Down

12 changes: 6 additions & 6 deletions
docs/docs/features/agents/review-agent.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -44,9 +44,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
 <Step title="Configure the environment variables in Sourcebot">
 Sourcebot requires the following environment variables to begin reviewing PRs through your new GitHub app:

 - `GITHUB_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
 - `GITHUB_REVIEW_AGENT_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
 (ex `/data/review-agent-key.pem`). You must copy the private key file into the directory you mount to Sourcebot (similar to the config file). 

 You can generate a private key file for your app in the [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings). You must copy this private key file into the
Expand DownExpand Up@@ -74,9 +74,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
 - "/Users/michael/sourcebot_review_agent_workspace:/data"
 environment:
 CONFIG_PATH: "/data/config.json"
GITHUB_APP_ID: "my-github-app-id"
GITHUB_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
GITHUB_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
GITHUB_REVIEW_AGENT_APP_ID: "my-github-app-id"
GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
 REVIEW_AGENT_API_KEY: "sourcebot-my-key"
 OPENAI_API_KEY: "sk-proj-my-open-api-key"
 ```
Expand Down

82 changes: 82 additions & 0 deletions
docs/snippets/schemas/v3/app.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
```json
{
 "$schema": "http://json-schema.org/draft-07/schema#",
 "title": "AppConfig",
 "oneOf": [
 {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "description": "The private key of the GitHub App.",
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ]
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
 }
 ]
}
```

76 changes: 76 additions & 0 deletions
docs/snippets/schemas/v3/githubApp.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
```json
{
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "description": "The private key of the GitHub App.",
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ]
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
}
```

83 changes: 83 additions & 0 deletions
docs/snippets/schemas/v3/index.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4273,6 +4273,89 @@
 }
 ]
 }
 },
 "apps": {
 "type": "array",
 "description": "Defines a collection of apps that are available to Sourcebot.",
 "items": {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "title": "AppConfig",
 "oneOf": [
 {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ],
 "description": "The private key of the GitHub App."
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
 }
 ]
 }
 }
 },
 "additionalProperties": false
Expand Down

1 change: 1 addition & 0 deletions
packages/backend/package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -24,6 +24,7 @@
 "dependencies": {
 "@coderabbitai/bitbucket": "^1.1.3",
 "@gitbeaker/rest": "^40.5.1",
 "@octokit/app": "^16.1.1",
 "@octokit/rest": "^21.0.2",
 "@sentry/cli": "^2.42.2",
 "@sentry/node": "^9.3.0",
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(auth): github app#570

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

msukkari
merged 9 commits into

from

Oct 22, 2025
 Merged


feat(auth): github app
#570
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
fa8e0d2

properly handle emails for github app auth case


msukkari Oct 18, 2025
b96a35a

add docs info for auth through github app


msukkari Oct 18, 2025
d69851c

more info in docs for user auth perms


msukkari Oct 18, 2025
1360caa

modify review agent env var names


msukkari Oct 21, 2025
1cd9007

github app service auth


msukkari Oct 22, 2025
4af3b53

coderabbit suggestions


msukkari Oct 22, 2025
b0dc257

merge main


msukkari Oct 22, 2025
2d2d540

fixes


msukkari Oct 22, 2025
49f1f05

fix build


msukkari Oct 22, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 2 additions & 3 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added
- Implement dynamic tab titles for files and folders in browse tab. [#560](https://github.com/sourcebot-dev/sourcebot/pull/560)
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)
- Added support for GitHub Apps for service auth. [#570](https://github.com/sourcebot-dev/sourcebot/pull/570)

### Fixed
- Fixed "dubious ownership" errors when cloning / fetching repos. [#553](https://github.com/sourcebot-dev/sourcebot/pull/553)
Expand All@@ -27,9 +29,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Removed spam "login page loaded" log. [#552](https://github.com/sourcebot-dev/sourcebot/pull/552)
- Removed connections management page. [#563](https://github.com/sourcebot-dev/sourcebot/pull/563)

### Added
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)

## [4.7.3] - 2025-09-29

### Fixed
Expand Down

2 changes: 1 addition & 1 deletion
docs/docs/configuration/auth/overview.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -10,7 +10,7 @@ Sourcebot's built-in authentication system gates your deployment, and allows adm
 <Card horizontal title="Authentication providers" icon="lock" href="/docs/configuration/auth/providers">
 Configure additional authentication providers for your deployment.
 </Card>
 <Card horizontal title="Inviting members" icon="user" href="/docs/configuration/auth/inviting-members">
 <Card horizontal title="Access settings" icon="user" href="/docs/configuration/auth/access-settings">
 Learn how to configure how members join your deployment.
 </Card>
 <Card horizontal title="Roles and permissions" icon="shield" href="/docs/configuration/auth/roles-and-permissions">
Expand Down

7 changes: 7 additions & 0 deletions
docs/docs/configuration/auth/providers.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33,6 +33,13 @@ The following authentication providers require an [enterprise license](/docs/lic

[Auth.js GitHub Provider Docs](https://authjs.dev/getting-started/providers/github)

Authentication using both a **GitHub OAuth App** and a **GitHub App** is supported. In both cases, you must provide Sourcebot the `CLIENT_ID` and `SECRET_ID` and configure the 
callback URL correctly (more info in Auth.js docs). 

When using a **GitHub App** for auth, enable the following permissions:
- `“Email addresses” account permissions (read)`
- `"Metadata" repository permissions (read)` (only needed if enabling [permission syncing](/docs/features/permission-syncing))

**Required environment variables:**
- `AUTH_EE_GITHUB_CLIENT_ID`
- `AUTH_EE_GITHUB_CLIENT_SECRET`
Expand Down

6 changes: 3 additions & 3 deletions
docs/docs/configuration/environment-variables.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -62,9 +62,9 @@ The following environment variables allow you to configure your Sourcebot deploy
### Review Agent Environment Variables
| Variable | Default | Description |
| :------- | :------ | :---------- |
| `GITHUB_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
| `GITHUB_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
| `GITHUB_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
| `GITHUB_REVIEW_AGENT_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
| `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
| `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
| `OPENAI_API_KEY` | `-` | <p>The OpenAI API key used by the review agent.</p> |
| `REVIEW_AGENT_API_KEY` | `-` | <p>The Sourcebot API key used by the review agent.</p> |
| `REVIEW_AGENT_AUTO_REVIEW_ENABLED` | `false` | <p>Enables/disables automatic code reviews by the review agent.</p> |
Expand Down

12 changes: 6 additions & 6 deletions
docs/docs/features/agents/review-agent.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -44,9 +44,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
 <Step title="Configure the environment variables in Sourcebot">
 Sourcebot requires the following environment variables to begin reviewing PRs through your new GitHub app:

 - `GITHUB_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
 - `GITHUB_REVIEW_AGENT_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
 (ex `/data/review-agent-key.pem`). You must copy the private key file into the directory you mount to Sourcebot (similar to the config file). 

 You can generate a private key file for your app in the [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings). You must copy this private key file into the
Expand DownExpand Up@@ -74,9 +74,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
 - "/Users/michael/sourcebot_review_agent_workspace:/data"
 environment:
 CONFIG_PATH: "/data/config.json"
GITHUB_APP_ID: "my-github-app-id"
GITHUB_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
GITHUB_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
GITHUB_REVIEW_AGENT_APP_ID: "my-github-app-id"
GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
 REVIEW_AGENT_API_KEY: "sourcebot-my-key"
 OPENAI_API_KEY: "sk-proj-my-open-api-key"
 ```
Expand Down

82 changes: 82 additions & 0 deletions
docs/snippets/schemas/v3/app.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
```json
{
 "$schema": "http://json-schema.org/draft-07/schema#",
 "title": "AppConfig",
 "oneOf": [
 {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "description": "The private key of the GitHub App.",
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ]
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
 }
 ]
}
```

76 changes: 76 additions & 0 deletions
docs/snippets/schemas/v3/githubApp.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
```json
{
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "description": "The private key of the GitHub App.",
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ]
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
}
```

83 changes: 83 additions & 0 deletions
docs/snippets/schemas/v3/index.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4273,6 +4273,89 @@
 }
 ]
 }
 },
 "apps": {
 "type": "array",
 "description": "Defines a collection of apps that are available to Sourcebot.",
 "items": {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "title": "AppConfig",
 "oneOf": [
 {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ],
 "description": "The private key of the GitHub App."
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
 }
 ]
 }
 }
 },
 "additionalProperties": false
Expand Down

1 change: 1 addition & 0 deletions
packages/backend/package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -24,6 +24,7 @@
 "dependencies": {
 "@coderabbitai/bitbucket": "^1.1.3",
 "@gitbeaker/rest": "^40.5.1",
 "@octokit/app": "^16.1.1",
 "@octokit/rest": "^21.0.2",
 "@sentry/cli": "^2.42.2",
 "@sentry/node": "^9.3.0",
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(auth): github app#570

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

msukkari
merged 9 commits into

from

Oct 22, 2025
 Merged


feat(auth): github app
#570
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
fa8e0d2

properly handle emails for github app auth case


msukkari Oct 18, 2025
b96a35a

add docs info for auth through github app


msukkari Oct 18, 2025
d69851c

more info in docs for user auth perms


msukkari Oct 18, 2025
1360caa

modify review agent env var names


msukkari Oct 21, 2025
1cd9007

github app service auth


msukkari Oct 22, 2025
4af3b53

coderabbit suggestions


msukkari Oct 22, 2025
b0dc257

merge main


msukkari Oct 22, 2025
2d2d540

fixes


msukkari Oct 22, 2025
49f1f05

fix build


msukkari Oct 22, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 2 additions & 3 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added
- Implement dynamic tab titles for files and folders in browse tab. [#560](https://github.com/sourcebot-dev/sourcebot/pull/560)
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)
- Added support for GitHub Apps for service auth. [#570](https://github.com/sourcebot-dev/sourcebot/pull/570)

### Fixed
- Fixed "dubious ownership" errors when cloning / fetching repos. [#553](https://github.com/sourcebot-dev/sourcebot/pull/553)
Expand All@@ -27,9 +29,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Removed spam "login page loaded" log. [#552](https://github.com/sourcebot-dev/sourcebot/pull/552)
- Removed connections management page. [#563](https://github.com/sourcebot-dev/sourcebot/pull/563)

### Added
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)

## [4.7.3] - 2025-09-29

### Fixed
Expand Down

2 changes: 1 addition & 1 deletion
docs/docs/configuration/auth/overview.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -10,7 +10,7 @@ Sourcebot's built-in authentication system gates your deployment, and allows adm
 <Card horizontal title="Authentication providers" icon="lock" href="/docs/configuration/auth/providers">
 Configure additional authentication providers for your deployment.
 </Card>
 <Card horizontal title="Inviting members" icon="user" href="/docs/configuration/auth/inviting-members">
 <Card horizontal title="Access settings" icon="user" href="/docs/configuration/auth/access-settings">
 Learn how to configure how members join your deployment.
 </Card>
 <Card horizontal title="Roles and permissions" icon="shield" href="/docs/configuration/auth/roles-and-permissions">
Expand Down

7 changes: 7 additions & 0 deletions
docs/docs/configuration/auth/providers.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33,6 +33,13 @@ The following authentication providers require an [enterprise license](/docs/lic

[Auth.js GitHub Provider Docs](https://authjs.dev/getting-started/providers/github)

Authentication using both a **GitHub OAuth App** and a **GitHub App** is supported. In both cases, you must provide Sourcebot the `CLIENT_ID` and `SECRET_ID` and configure the 
callback URL correctly (more info in Auth.js docs). 

When using a **GitHub App** for auth, enable the following permissions:
- `“Email addresses” account permissions (read)`
- `"Metadata" repository permissions (read)` (only needed if enabling [permission syncing](/docs/features/permission-syncing))

**Required environment variables:**
- `AUTH_EE_GITHUB_CLIENT_ID`
- `AUTH_EE_GITHUB_CLIENT_SECRET`
Expand Down

6 changes: 3 additions & 3 deletions
docs/docs/configuration/environment-variables.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -62,9 +62,9 @@ The following environment variables allow you to configure your Sourcebot deploy
### Review Agent Environment Variables
| Variable | Default | Description |
| :------- | :------ | :---------- |
| `GITHUB_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
| `GITHUB_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
| `GITHUB_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
| `GITHUB_REVIEW_AGENT_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
| `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
| `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
| `OPENAI_API_KEY` | `-` | <p>The OpenAI API key used by the review agent.</p> |
| `REVIEW_AGENT_API_KEY` | `-` | <p>The Sourcebot API key used by the review agent.</p> |
| `REVIEW_AGENT_AUTO_REVIEW_ENABLED` | `false` | <p>Enables/disables automatic code reviews by the review agent.</p> |
Expand Down

12 changes: 6 additions & 6 deletions
docs/docs/features/agents/review-agent.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -44,9 +44,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
 <Step title="Configure the environment variables in Sourcebot">
 Sourcebot requires the following environment variables to begin reviewing PRs through your new GitHub app:

 - `GITHUB_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
 - `GITHUB_REVIEW_AGENT_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
 (ex `/data/review-agent-key.pem`). You must copy the private key file into the directory you mount to Sourcebot (similar to the config file). 

 You can generate a private key file for your app in the [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings). You must copy this private key file into the
Expand DownExpand Up@@ -74,9 +74,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
 - "/Users/michael/sourcebot_review_agent_workspace:/data"
 environment:
 CONFIG_PATH: "/data/config.json"
GITHUB_APP_ID: "my-github-app-id"
GITHUB_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
GITHUB_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
GITHUB_REVIEW_AGENT_APP_ID: "my-github-app-id"
GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
 REVIEW_AGENT_API_KEY: "sourcebot-my-key"
 OPENAI_API_KEY: "sk-proj-my-open-api-key"
 ```
Expand Down

82 changes: 82 additions & 0 deletions
docs/snippets/schemas/v3/app.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
```json
{
 "$schema": "http://json-schema.org/draft-07/schema#",
 "title": "AppConfig",
 "oneOf": [
 {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "description": "The private key of the GitHub App.",
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ]
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
 }
 ]
}
```

76 changes: 76 additions & 0 deletions
docs/snippets/schemas/v3/githubApp.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
```json
{
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "description": "The private key of the GitHub App.",
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ]
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
}
```

83 changes: 83 additions & 0 deletions
docs/snippets/schemas/v3/index.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4273,6 +4273,89 @@
 }
 ]
 }
 },
 "apps": {
 "type": "array",
 "description": "Defines a collection of apps that are available to Sourcebot.",
 "items": {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "title": "AppConfig",
 "oneOf": [
 {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ],
 "description": "The private key of the GitHub App."
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
 }
 ]
 }
 }
 },
 "additionalProperties": false
Expand Down

1 change: 1 addition & 0 deletions
packages/backend/package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -24,6 +24,7 @@
 "dependencies": {
 "@coderabbitai/bitbucket": "^1.1.3",
 "@gitbeaker/rest": "^40.5.1",
 "@octokit/app": "^16.1.1",
 "@octokit/rest": "^21.0.2",
 "@sentry/cli": "^2.42.2",
 "@sentry/node": "^9.3.0",
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat(auth): github app#570

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

msukkari
merged 9 commits into

from

Oct 22, 2025
 Merged


feat(auth): github app
#570
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
fa8e0d2

properly handle emails for github app auth case


msukkari Oct 18, 2025
b96a35a

add docs info for auth through github app


msukkari Oct 18, 2025
d69851c

more info in docs for user auth perms


msukkari Oct 18, 2025
1360caa

modify review agent env var names


msukkari Oct 21, 2025
1cd9007

github app service auth


msukkari Oct 22, 2025
4af3b53

coderabbit suggestions


msukkari Oct 22, 2025
b0dc257

merge main


msukkari Oct 22, 2025
2d2d540

fixes


msukkari Oct 22, 2025
49f1f05

fix build


msukkari Oct 22, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 2 additions & 3 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added
- Implement dynamic tab titles for files and folders in browse tab. [#560](https://github.com/sourcebot-dev/sourcebot/pull/560)
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)
- Added support for GitHub Apps for service auth. [#570](https://github.com/sourcebot-dev/sourcebot/pull/570)

### Fixed
- Fixed "dubious ownership" errors when cloning / fetching repos. [#553](https://github.com/sourcebot-dev/sourcebot/pull/553)
Expand All@@ -27,9 +29,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Removed spam "login page loaded" log. [#552](https://github.com/sourcebot-dev/sourcebot/pull/552)
- Removed connections management page. [#563](https://github.com/sourcebot-dev/sourcebot/pull/563)

### Added
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)

## [4.7.3] - 2025-09-29

### Fixed
Expand Down

2 changes: 1 addition & 1 deletion
docs/docs/configuration/auth/overview.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -10,7 +10,7 @@ Sourcebot's built-in authentication system gates your deployment, and allows adm
 <Card horizontal title="Authentication providers" icon="lock" href="/docs/configuration/auth/providers">
 Configure additional authentication providers for your deployment.
 </Card>
 <Card horizontal title="Inviting members" icon="user" href="/docs/configuration/auth/inviting-members">
 <Card horizontal title="Access settings" icon="user" href="/docs/configuration/auth/access-settings">
 Learn how to configure how members join your deployment.
 </Card>
 <Card horizontal title="Roles and permissions" icon="shield" href="/docs/configuration/auth/roles-and-permissions">
Expand Down

7 changes: 7 additions & 0 deletions
docs/docs/configuration/auth/providers.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33,6 +33,13 @@ The following authentication providers require an [enterprise license](/docs/lic

[Auth.js GitHub Provider Docs](https://authjs.dev/getting-started/providers/github)

Authentication using both a **GitHub OAuth App** and a **GitHub App** is supported. In both cases, you must provide Sourcebot the `CLIENT_ID` and `SECRET_ID` and configure the 
callback URL correctly (more info in Auth.js docs). 

When using a **GitHub App** for auth, enable the following permissions:
- `“Email addresses” account permissions (read)`
- `"Metadata" repository permissions (read)` (only needed if enabling [permission syncing](/docs/features/permission-syncing))

**Required environment variables:**
- `AUTH_EE_GITHUB_CLIENT_ID`
- `AUTH_EE_GITHUB_CLIENT_SECRET`
Expand Down

6 changes: 3 additions & 3 deletions
docs/docs/configuration/environment-variables.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -62,9 +62,9 @@ The following environment variables allow you to configure your Sourcebot deploy
### Review Agent Environment Variables
| Variable | Default | Description |
| :------- | :------ | :---------- |
| `GITHUB_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
| `GITHUB_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
| `GITHUB_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
| `GITHUB_REVIEW_AGENT_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
| `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
| `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
| `OPENAI_API_KEY` | `-` | <p>The OpenAI API key used by the review agent.</p> |
| `REVIEW_AGENT_API_KEY` | `-` | <p>The Sourcebot API key used by the review agent.</p> |
| `REVIEW_AGENT_AUTO_REVIEW_ENABLED` | `false` | <p>Enables/disables automatic code reviews by the review agent.</p> |
Expand Down

12 changes: 6 additions & 6 deletions
docs/docs/features/agents/review-agent.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -44,9 +44,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
 <Step title="Configure the environment variables in Sourcebot">
 Sourcebot requires the following environment variables to begin reviewing PRs through your new GitHub app:

 - `GITHUB_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
 - `GITHUB_REVIEW_AGENT_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
 (ex `/data/review-agent-key.pem`). You must copy the private key file into the directory you mount to Sourcebot (similar to the config file). 

 You can generate a private key file for your app in the [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings). You must copy this private key file into the
Expand DownExpand Up@@ -74,9 +74,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
 - "/Users/michael/sourcebot_review_agent_workspace:/data"
 environment:
 CONFIG_PATH: "/data/config.json"
GITHUB_APP_ID: "my-github-app-id"
GITHUB_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
GITHUB_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
GITHUB_REVIEW_AGENT_APP_ID: "my-github-app-id"
GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
 REVIEW_AGENT_API_KEY: "sourcebot-my-key"
 OPENAI_API_KEY: "sk-proj-my-open-api-key"
 ```
Expand Down

82 changes: 82 additions & 0 deletions
docs/snippets/schemas/v3/app.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
```json
{
 "$schema": "http://json-schema.org/draft-07/schema#",
 "title": "AppConfig",
 "oneOf": [
 {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "description": "The private key of the GitHub App.",
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ]
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
 }
 ]
}
```

76 changes: 76 additions & 0 deletions
docs/snippets/schemas/v3/githubApp.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
```json
{
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "description": "The private key of the GitHub App.",
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ]
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
}
```

83 changes: 83 additions & 0 deletions
docs/snippets/schemas/v3/index.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4273,6 +4273,89 @@
 }
 ]
 }
 },
 "apps": {
 "type": "array",
 "description": "Defines a collection of apps that are available to Sourcebot.",
 "items": {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "title": "AppConfig",
 "oneOf": [
 {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ],
 "description": "The private key of the GitHub App."
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
 }
 ]
 }
 }
 },
 "additionalProperties": false
Expand Down

1 change: 1 addition & 0 deletions
packages/backend/package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -24,6 +24,7 @@
 "dependencies": {
 "@coderabbitai/bitbucket": "^1.1.3",
 "@gitbeaker/rest": "^40.5.1",
 "@octokit/app": "^16.1.1",
 "@octokit/rest": "^21.0.2",
 "@sentry/cli": "^2.42.2",
 "@sentry/node": "^9.3.0",
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(auth): github app#570

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

msukkari
merged 9 commits into

from

Oct 22, 2025
 Merged


feat(auth): github app
#570
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
fa8e0d2

properly handle emails for github app auth case


msukkari Oct 18, 2025
b96a35a

add docs info for auth through github app


msukkari Oct 18, 2025
d69851c

more info in docs for user auth perms


msukkari Oct 18, 2025
1360caa

modify review agent env var names


msukkari Oct 21, 2025
1cd9007

github app service auth


msukkari Oct 22, 2025
4af3b53

coderabbit suggestions


msukkari Oct 22, 2025
b0dc257

merge main


msukkari Oct 22, 2025
2d2d540

fixes


msukkari Oct 22, 2025
49f1f05

fix build


msukkari Oct 22, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 2 additions & 3 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added
- Implement dynamic tab titles for files and folders in browse tab. [#560](https://github.com/sourcebot-dev/sourcebot/pull/560)
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)
- Added support for GitHub Apps for service auth. [#570](https://github.com/sourcebot-dev/sourcebot/pull/570)

### Fixed
- Fixed "dubious ownership" errors when cloning / fetching repos. [#553](https://github.com/sourcebot-dev/sourcebot/pull/553)
Expand All@@ -27,9 +29,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Removed spam "login page loaded" log. [#552](https://github.com/sourcebot-dev/sourcebot/pull/552)
- Removed connections management page. [#563](https://github.com/sourcebot-dev/sourcebot/pull/563)

### Added
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)

## [4.7.3] - 2025-09-29

### Fixed
Expand Down

2 changes: 1 addition & 1 deletion
docs/docs/configuration/auth/overview.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -10,7 +10,7 @@ Sourcebot's built-in authentication system gates your deployment, and allows adm
 <Card horizontal title="Authentication providers" icon="lock" href="/docs/configuration/auth/providers">
 Configure additional authentication providers for your deployment.
 </Card>
 <Card horizontal title="Inviting members" icon="user" href="/docs/configuration/auth/inviting-members">
 <Card horizontal title="Access settings" icon="user" href="/docs/configuration/auth/access-settings">
 Learn how to configure how members join your deployment.
 </Card>
 <Card horizontal title="Roles and permissions" icon="shield" href="/docs/configuration/auth/roles-and-permissions">
Expand Down

7 changes: 7 additions & 0 deletions
docs/docs/configuration/auth/providers.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33,6 +33,13 @@ The following authentication providers require an [enterprise license](/docs/lic

[Auth.js GitHub Provider Docs](https://authjs.dev/getting-started/providers/github)

Authentication using both a **GitHub OAuth App** and a **GitHub App** is supported. In both cases, you must provide Sourcebot the `CLIENT_ID` and `SECRET_ID` and configure the 
callback URL correctly (more info in Auth.js docs). 

When using a **GitHub App** for auth, enable the following permissions:
- `“Email addresses” account permissions (read)`
- `"Metadata" repository permissions (read)` (only needed if enabling [permission syncing](/docs/features/permission-syncing))

**Required environment variables:**
- `AUTH_EE_GITHUB_CLIENT_ID`
- `AUTH_EE_GITHUB_CLIENT_SECRET`
Expand Down

6 changes: 3 additions & 3 deletions
docs/docs/configuration/environment-variables.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -62,9 +62,9 @@ The following environment variables allow you to configure your Sourcebot deploy
### Review Agent Environment Variables
| Variable | Default | Description |
| :------- | :------ | :---------- |
| `GITHUB_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
| `GITHUB_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
| `GITHUB_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
| `GITHUB_REVIEW_AGENT_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
| `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
| `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
| `OPENAI_API_KEY` | `-` | <p>The OpenAI API key used by the review agent.</p> |
| `REVIEW_AGENT_API_KEY` | `-` | <p>The Sourcebot API key used by the review agent.</p> |
| `REVIEW_AGENT_AUTO_REVIEW_ENABLED` | `false` | <p>Enables/disables automatic code reviews by the review agent.</p> |
Expand Down

12 changes: 6 additions & 6 deletions
docs/docs/features/agents/review-agent.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -44,9 +44,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
 <Step title="Configure the environment variables in Sourcebot">
 Sourcebot requires the following environment variables to begin reviewing PRs through your new GitHub app:

 - `GITHUB_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
 - `GITHUB_REVIEW_AGENT_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
 (ex `/data/review-agent-key.pem`). You must copy the private key file into the directory you mount to Sourcebot (similar to the config file). 

 You can generate a private key file for your app in the [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings). You must copy this private key file into the
Expand DownExpand Up@@ -74,9 +74,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
 - "/Users/michael/sourcebot_review_agent_workspace:/data"
 environment:
 CONFIG_PATH: "/data/config.json"
GITHUB_APP_ID: "my-github-app-id"
GITHUB_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
GITHUB_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
GITHUB_REVIEW_AGENT_APP_ID: "my-github-app-id"
GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
 REVIEW_AGENT_API_KEY: "sourcebot-my-key"
 OPENAI_API_KEY: "sk-proj-my-open-api-key"
 ```
Expand Down

82 changes: 82 additions & 0 deletions
docs/snippets/schemas/v3/app.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
```json
{
 "$schema": "http://json-schema.org/draft-07/schema#",
 "title": "AppConfig",
 "oneOf": [
 {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "description": "The private key of the GitHub App.",
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ]
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
 }
 ]
}
```

76 changes: 76 additions & 0 deletions
docs/snippets/schemas/v3/githubApp.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
```json
{
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "description": "The private key of the GitHub App.",
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ]
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
}
```

83 changes: 83 additions & 0 deletions
docs/snippets/schemas/v3/index.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4273,6 +4273,89 @@
 }
 ]
 }
 },
 "apps": {
 "type": "array",
 "description": "Defines a collection of apps that are available to Sourcebot.",
 "items": {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "title": "AppConfig",
 "oneOf": [
 {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ],
 "description": "The private key of the GitHub App."
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
 }
 ]
 }
 }
 },
 "additionalProperties": false
Expand Down

1 change: 1 addition & 0 deletions
packages/backend/package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -24,6 +24,7 @@
 "dependencies": {
 "@coderabbitai/bitbucket": "^1.1.3",
 "@gitbeaker/rest": "^40.5.1",
 "@octokit/app": "^16.1.1",
 "@octokit/rest": "^21.0.2",
 "@sentry/cli": "^2.42.2",
 "@sentry/node": "^9.3.0",
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(auth): github app#570

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

msukkari
merged 9 commits into

from

Oct 22, 2025
 Merged


feat(auth): github app
#570
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
fa8e0d2

properly handle emails for github app auth case


msukkari Oct 18, 2025
b96a35a

add docs info for auth through github app


msukkari Oct 18, 2025
d69851c

more info in docs for user auth perms


msukkari Oct 18, 2025
1360caa

modify review agent env var names


msukkari Oct 21, 2025
1cd9007

github app service auth


msukkari Oct 22, 2025
4af3b53

coderabbit suggestions


msukkari Oct 22, 2025
b0dc257

merge main


msukkari Oct 22, 2025
2d2d540

fixes


msukkari Oct 22, 2025
49f1f05

fix build


msukkari Oct 22, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 2 additions & 3 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added
- Implement dynamic tab titles for files and folders in browse tab. [#560](https://github.com/sourcebot-dev/sourcebot/pull/560)
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)
- Added support for GitHub Apps for service auth. [#570](https://github.com/sourcebot-dev/sourcebot/pull/570)

### Fixed
- Fixed "dubious ownership" errors when cloning / fetching repos. [#553](https://github.com/sourcebot-dev/sourcebot/pull/553)
Expand All@@ -27,9 +29,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Removed spam "login page loaded" log. [#552](https://github.com/sourcebot-dev/sourcebot/pull/552)
- Removed connections management page. [#563](https://github.com/sourcebot-dev/sourcebot/pull/563)

### Added
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)

## [4.7.3] - 2025-09-29

### Fixed
Expand Down

2 changes: 1 addition & 1 deletion
docs/docs/configuration/auth/overview.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -10,7 +10,7 @@ Sourcebot's built-in authentication system gates your deployment, and allows adm
 <Card horizontal title="Authentication providers" icon="lock" href="/docs/configuration/auth/providers">
 Configure additional authentication providers for your deployment.
 </Card>
 <Card horizontal title="Inviting members" icon="user" href="/docs/configuration/auth/inviting-members">
 <Card horizontal title="Access settings" icon="user" href="/docs/configuration/auth/access-settings">
 Learn how to configure how members join your deployment.
 </Card>
 <Card horizontal title="Roles and permissions" icon="shield" href="/docs/configuration/auth/roles-and-permissions">
Expand Down

7 changes: 7 additions & 0 deletions
docs/docs/configuration/auth/providers.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33,6 +33,13 @@ The following authentication providers require an [enterprise license](/docs/lic

[Auth.js GitHub Provider Docs](https://authjs.dev/getting-started/providers/github)

Authentication using both a **GitHub OAuth App** and a **GitHub App** is supported. In both cases, you must provide Sourcebot the `CLIENT_ID` and `SECRET_ID` and configure the 
callback URL correctly (more info in Auth.js docs). 

When using a **GitHub App** for auth, enable the following permissions:
- `“Email addresses” account permissions (read)`
- `"Metadata" repository permissions (read)` (only needed if enabling [permission syncing](/docs/features/permission-syncing))

**Required environment variables:**
- `AUTH_EE_GITHUB_CLIENT_ID`
- `AUTH_EE_GITHUB_CLIENT_SECRET`
Expand Down

6 changes: 3 additions & 3 deletions
docs/docs/configuration/environment-variables.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -62,9 +62,9 @@ The following environment variables allow you to configure your Sourcebot deploy
### Review Agent Environment Variables
| Variable | Default | Description |
| :------- | :------ | :---------- |
| `GITHUB_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
| `GITHUB_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
| `GITHUB_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
| `GITHUB_REVIEW_AGENT_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
| `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
| `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
| `OPENAI_API_KEY` | `-` | <p>The OpenAI API key used by the review agent.</p> |
| `REVIEW_AGENT_API_KEY` | `-` | <p>The Sourcebot API key used by the review agent.</p> |
| `REVIEW_AGENT_AUTO_REVIEW_ENABLED` | `false` | <p>Enables/disables automatic code reviews by the review agent.</p> |
Expand Down

12 changes: 6 additions & 6 deletions
docs/docs/features/agents/review-agent.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -44,9 +44,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
 <Step title="Configure the environment variables in Sourcebot">
 Sourcebot requires the following environment variables to begin reviewing PRs through your new GitHub app:

 - `GITHUB_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
 - `GITHUB_REVIEW_AGENT_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
 (ex `/data/review-agent-key.pem`). You must copy the private key file into the directory you mount to Sourcebot (similar to the config file). 

 You can generate a private key file for your app in the [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings). You must copy this private key file into the
Expand DownExpand Up@@ -74,9 +74,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
 - "/Users/michael/sourcebot_review_agent_workspace:/data"
 environment:
 CONFIG_PATH: "/data/config.json"
GITHUB_APP_ID: "my-github-app-id"
GITHUB_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
GITHUB_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
GITHUB_REVIEW_AGENT_APP_ID: "my-github-app-id"
GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
 REVIEW_AGENT_API_KEY: "sourcebot-my-key"
 OPENAI_API_KEY: "sk-proj-my-open-api-key"
 ```
Expand Down

82 changes: 82 additions & 0 deletions
docs/snippets/schemas/v3/app.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
```json
{
 "$schema": "http://json-schema.org/draft-07/schema#",
 "title": "AppConfig",
 "oneOf": [
 {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "description": "The private key of the GitHub App.",
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ]
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
 }
 ]
}
```

76 changes: 76 additions & 0 deletions
docs/snippets/schemas/v3/githubApp.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
```json
{
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "description": "The private key of the GitHub App.",
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ]
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
}
```

83 changes: 83 additions & 0 deletions
docs/snippets/schemas/v3/index.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4273,6 +4273,89 @@
 }
 ]
 }
 },
 "apps": {
 "type": "array",
 "description": "Defines a collection of apps that are available to Sourcebot.",
 "items": {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "title": "AppConfig",
 "oneOf": [
 {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ],
 "description": "The private key of the GitHub App."
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
 }
 ]
 }
 }
 },
 "additionalProperties": false
Expand Down

1 change: 1 addition & 0 deletions
packages/backend/package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -24,6 +24,7 @@
 "dependencies": {
 "@coderabbitai/bitbucket": "^1.1.3",
 "@gitbeaker/rest": "^40.5.1",
 "@octokit/app": "^16.1.1",
 "@octokit/rest": "^21.0.2",
 "@sentry/cli": "^2.42.2",
 "@sentry/node": "^9.3.0",
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat(auth): github app#570

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

msukkari
merged 9 commits into

from

Oct 22, 2025
 Merged


feat(auth): github app
#570
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
fa8e0d2

properly handle emails for github app auth case


msukkari Oct 18, 2025
b96a35a

add docs info for auth through github app


msukkari Oct 18, 2025
d69851c

more info in docs for user auth perms


msukkari Oct 18, 2025
1360caa

modify review agent env var names


msukkari Oct 21, 2025
1cd9007

github app service auth


msukkari Oct 22, 2025
4af3b53

coderabbit suggestions


msukkari Oct 22, 2025
b0dc257

merge main


msukkari Oct 22, 2025
2d2d540

fixes


msukkari Oct 22, 2025
49f1f05

fix build


msukkari Oct 22, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 2 additions & 3 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added
- Implement dynamic tab titles for files and folders in browse tab. [#560](https://github.com/sourcebot-dev/sourcebot/pull/560)
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)
- Added support for GitHub Apps for service auth. [#570](https://github.com/sourcebot-dev/sourcebot/pull/570)

### Fixed
- Fixed "dubious ownership" errors when cloning / fetching repos. [#553](https://github.com/sourcebot-dev/sourcebot/pull/553)
Expand All@@ -27,9 +29,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Removed spam "login page loaded" log. [#552](https://github.com/sourcebot-dev/sourcebot/pull/552)
- Removed connections management page. [#563](https://github.com/sourcebot-dev/sourcebot/pull/563)

### Added
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)

## [4.7.3] - 2025-09-29

### Fixed
Expand Down

2 changes: 1 addition & 1 deletion
docs/docs/configuration/auth/overview.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -10,7 +10,7 @@ Sourcebot's built-in authentication system gates your deployment, and allows adm
 <Card horizontal title="Authentication providers" icon="lock" href="/docs/configuration/auth/providers">
 Configure additional authentication providers for your deployment.
 </Card>
 <Card horizontal title="Inviting members" icon="user" href="/docs/configuration/auth/inviting-members">
 <Card horizontal title="Access settings" icon="user" href="/docs/configuration/auth/access-settings">
 Learn how to configure how members join your deployment.
 </Card>
 <Card horizontal title="Roles and permissions" icon="shield" href="/docs/configuration/auth/roles-and-permissions">
Expand Down

7 changes: 7 additions & 0 deletions
docs/docs/configuration/auth/providers.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33,6 +33,13 @@ The following authentication providers require an [enterprise license](/docs/lic

[Auth.js GitHub Provider Docs](https://authjs.dev/getting-started/providers/github)

Authentication using both a **GitHub OAuth App** and a **GitHub App** is supported. In both cases, you must provide Sourcebot the `CLIENT_ID` and `SECRET_ID` and configure the 
callback URL correctly (more info in Auth.js docs). 

When using a **GitHub App** for auth, enable the following permissions:
- `“Email addresses” account permissions (read)`
- `"Metadata" repository permissions (read)` (only needed if enabling [permission syncing](/docs/features/permission-syncing))

**Required environment variables:**
- `AUTH_EE_GITHUB_CLIENT_ID`
- `AUTH_EE_GITHUB_CLIENT_SECRET`
Expand Down

6 changes: 3 additions & 3 deletions
docs/docs/configuration/environment-variables.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -62,9 +62,9 @@ The following environment variables allow you to configure your Sourcebot deploy
### Review Agent Environment Variables
| Variable | Default | Description |
| :------- | :------ | :---------- |
| `GITHUB_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
| `GITHUB_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
| `GITHUB_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
| `GITHUB_REVIEW_AGENT_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
| `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
| `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
| `OPENAI_API_KEY` | `-` | <p>The OpenAI API key used by the review agent.</p> |
| `REVIEW_AGENT_API_KEY` | `-` | <p>The Sourcebot API key used by the review agent.</p> |
| `REVIEW_AGENT_AUTO_REVIEW_ENABLED` | `false` | <p>Enables/disables automatic code reviews by the review agent.</p> |
Expand Down

12 changes: 6 additions & 6 deletions
docs/docs/features/agents/review-agent.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -44,9 +44,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
 <Step title="Configure the environment variables in Sourcebot">
 Sourcebot requires the following environment variables to begin reviewing PRs through your new GitHub app:

 - `GITHUB_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
 - `GITHUB_REVIEW_AGENT_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
 - `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
 (ex `/data/review-agent-key.pem`). You must copy the private key file into the directory you mount to Sourcebot (similar to the config file). 

 You can generate a private key file for your app in the [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings). You must copy this private key file into the
Expand DownExpand Up@@ -74,9 +74,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
 - "/Users/michael/sourcebot_review_agent_workspace:/data"
 environment:
 CONFIG_PATH: "/data/config.json"
GITHUB_APP_ID: "my-github-app-id"
GITHUB_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
GITHUB_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
GITHUB_REVIEW_AGENT_APP_ID: "my-github-app-id"
GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
 REVIEW_AGENT_API_KEY: "sourcebot-my-key"
 OPENAI_API_KEY: "sk-proj-my-open-api-key"
 ```
Expand Down

82 changes: 82 additions & 0 deletions
docs/snippets/schemas/v3/app.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
```json
{
 "$schema": "http://json-schema.org/draft-07/schema#",
 "title": "AppConfig",
 "oneOf": [
 {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "description": "The private key of the GitHub App.",
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ]
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
 }
 ]
}
```

76 changes: 76 additions & 0 deletions
docs/snippets/schemas/v3/githubApp.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
```json
{
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "description": "The private key of the GitHub App.",
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ]
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
}
```

83 changes: 83 additions & 0 deletions
docs/snippets/schemas/v3/index.schema.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4273,6 +4273,89 @@
 }
 ]
 }
 },
 "apps": {
 "type": "array",
 "description": "Defines a collection of apps that are available to Sourcebot.",
 "items": {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "title": "AppConfig",
 "oneOf": [
 {
 "$schema": "http://json-schema.org/draft-07/schema#",
 "type": "object",
 "title": "GithubAppConfig",
 "properties": {
 "type": {
 "const": "githubApp",
 "description": "GitHub App Configuration"
 },
 "deploymentHostname": {
 "type": "string",
 "format": "hostname",
 "default": "github.com",
 "description": "The hostname of the GitHub App deployment.",
 "examples": [
 "github.com",
 "github.example.com"
 ]
 },
 "id": {
 "type": "string",
 "description": "The ID of the GitHub App."
 },
 "privateKey": {
 "anyOf": [
 {
 "type": "object",
 "properties": {
 "secret": {
 "type": "string",
 "description": "The name of the secret that contains the token."
 }
 },
 "required": [
 "secret"
 ],
 "additionalProperties": false
 },
 {
 "type": "object",
 "properties": {
 "env": {
 "type": "string",
 "description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
 }
 },
 "required": [
 "env"
 ],
 "additionalProperties": false
 }
 ],
 "description": "The private key of the GitHub App."
 }
 },
 "required": [
 "type",
 "id"
 ],
 "oneOf": [
 {
 "required": [
 "privateKey"
 ]
 },
 {
 "required": [
 "privateKeyPath"
 ]
 }
 ],
 "additionalProperties": false
 }
 ]
 }
 }
 },
 "additionalProperties": false
Expand Down

1 change: 1 addition & 0 deletions
packages/backend/package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -24,6 +24,7 @@
 "dependencies": {
 "@coderabbitai/bitbucket": "^1.1.3",
 "@gitbeaker/rest": "^40.5.1",
 "@octokit/app": "^16.1.1",
 "@octokit/rest": "^21.0.2",
 "@sentry/cli": "^2.42.2",
 "@sentry/node": "^9.3.0",
Expand Down
Loading
Loading