GitHub access
Exact GitHub App permissions, their call sites, and the current installation boundary.
Availability first
Verified 2026-09-26: Production has a configured GitHub App installation flow, webhook secret, exact-revision archive transport, signed storage, and sandbox worker. An organization must explicitly authorize repositories before pull-request events can create runs.
The checked-in GitHub App manifest is marked "public": false, so installation
availability remains limited by the App's GitHub visibility settings.
Requested repository permissions
The source-of-truth manifest is docs/operations/github-app-manifest.json.
| GitHub App permission | Access | Why the code requests it |
|---|---|---|
| Repository metadata | Read | GitHub-required repository identity metadata. |
| Pull requests | Read | Fetch the pull-request diff through GitHub's pull-request endpoint. |
| Issues | Write | Create or update a PR conversation comment; GitHub exposes PR comments through the issues endpoint. |
| Checks | Write | Create and update the Deton check run on the PR head SHA. |
The current manifest does not request repository contents access and does
not request a source-code write permission. Its write scopes are for check runs
and PR comments. They do not authorize Deton to push, merge, or modify a branch.
The corresponding call sites are
src/libs/deton/github-diff-fetch.ts and
src/libs/deton/github-checks-client.ts.
Subscribed events
The manifest subscribes to:
pull_request;installation;installation_repositories.
The webhook parser handles relevant PR lifecycle events and installation state. Webhook receipt is not evidence that sandbox proof completed.
Request path
The configured path:
- issue a signed, expiring, single-use installation state bound to the Deton organization and user;
- re-check owner/admin authority at callback time;
- store the GitHub installation and its granted-permission snapshot;
- receive PR events and fetch the changed diff with a short-lived installation token;
- run the diff candidate detector;
- request a result from the isolated runner for eligible candidates;
- submit supplied result fields to the pure evaluator, construct formatter payloads only from eligible in-memory security-issue values, and attempt delivery only if an authorized adapter is available. Construction or an attempted delivery does not prove record origin, live execution, independent custody, persistence, delivery success, or canonical publication. The current production path does not persist an evidence artifact.
The state-token and installation logic is in
src/libs/deton/github-connect-state.ts and
src/libs/deton/github-install.ts. Publication gating is in
src/libs/deton/github-output.ts.
Source-execution boundary
src/jobs/deton.ts acquires the exact GitHub commit archive with a short-lived
installation token, stores immutable bytes in S3-compatible storage, and gives
the runner a short-lived reference bound to the archive SHA-256. The runner
accepts only HTTPS from the configured archive host (or a canonical Cloudflare
R2 account host), enforces a compressed-size cap, verifies the hash, and uses a
hardened extractor before recipe resolution.
The Next.js control plane never executes customer code and the runner never receives GitHub installation, database, billing, or cloud credentials.