GitHub Authentication & Scopes
Connect repositories via 1-click GitHub App with automatic installation token rotation, or configure a fine-grained Personal Access Token.
Option A (Recommended) · GitHub App 1-Click Integration
Ichnois includes built-in GitHub App authentication. Instead of managing individual user PATs that expire, a GitHub App mints short-lived, ephemeral installation access tokens on-demand signed via RS256 JWT.
Configure GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY in your environment. Once installed on your organization, Ichnois automatically discovers repositories and assigns scoped permissions without manual credential handling.
Option B · Fine-grained Personal Access Token (PAT)
If you prefer not to register a GitHub App, you can configure a standard fine-grained PAT. In GitHub, go to Settings → Developer settings → Personal access tokens → Fine-grained tokens and click Generate new token.
Set the resource owner to the organisation or user that owns the target repository, then configure the permissions below.
Required permissions
| 1 | # Required fine-grained PAT permissions |
| 2 | Repository permissions: |
| 3 | Contents: Read (clone + blame GraphQL) |
| 4 | Issues: Read/Write (draft & publish issues) |
| 5 | Pull requests: Read (link to suspect PR, optional) |
| 6 | |
| 7 | Account permissions: |
| 8 | (none required) |
| 9 | |
| 10 | # Ichnois NEVER uses: |
| 11 | - Actions, Workflows, Secrets, Admin, Deployments |
| 12 | - Write access to Contents or Code |
Set the token in your environment
| 1 | GITHUB_TOKEN=github_pat_11AB… |
| 2 | GITHUB_REPO=your-org/your-repo |
What Ichnois does with the token
- Issues a GitHub GraphQL blame query pinned to the deployed release commit SHA to find the line author
- Fetches the suspect commit diff via REST API (
GET /repos/:owner/:repo/commits/:sha), truncated to ≤ 6 KB - Creates a GitHub issue in draft state only after explicit human approval in the dashboard
Classic PAT (legacy fallback)
If your organisation does not yet support fine-grained PATs, a classic PAT with the repo scope works but grants broader read/write access. Prefer fine-grained tokens for production.