GitHub App

Every other integration goes through one provider. GitHub, reached as a GitHub App, does not, and it is worth being precise about why, because it is the only exception in the product.

Why the exception exists

The integration provider's GitHub toolkit offers OAuth2 alone. It rejects bearer tokens outright, and an imported installation token never finishes connecting. Installation auth simply cannot be expressed through it.

Why that auth is worth it

A GitHub App's permissions come from its installation, not from OAuth scopes.

That inverts the usual risk. An OAuth grant asks a person for access to everything their account can reach, and gets it. An App can only reach what the installation granted, it cannot ask for private repositories or a person's account data unless somebody installing it agreed to exactly that.

And no person is bound to the token. When the person who set it up leaves, the installation carries on. Compare that with an OAuth connection that quietly dies with its owner's account.

Installing

1. 1

   Install the App on your GitHub organization

   Choose which repositories it may reach. Fewer is better, you can widen later.

2. 2

   Connect the installation to a workspace

   Connectors → GitHub App lists the installations Memnox can see. Pick the one you just created and attach it to the workspace its events belong to.

3. 3

   Point the webhook at your instance

   The same screen shows the URL and the secret to paste into the App's settings. GitHub then delivers directly here, signed with that secret.

4. 4

   Backfill, if you want history

   See Backfilling history.

Webhook verification

Deliveries carry x-hub-signature-256: HMAC-SHA256 over the raw bytes with the App's webhook secret, compared in constant time.

Raw bytes matter, a re-serialized JSON body is a different byte string and will not verify. See Webhooks and signatures.

What GitHub contributes

Pull requests, issues, comments and releases arrive as source events with permalinks that need no composition. GitHub sends real URLs.

Author trust is actor-aware: an issue or comment from an OWNER, MEMBER or COLLABORATOR is trusted, while the same text from NONE is tainted. File and symbol content is ground truth and never tainted.

OAuth GitHub is still available

If installation auth is more than you need, the ordinary GitHub toolkit connects through the provider like anything else. You lose installation-scoped permissions and gain the usual OAuth behaviour, including dying with its owner's account.

For most organizations the App is the better choice.