GitHub

The GitHub package can inspect repositories, issues, pull requests, branches, commits, and files. It can also publish approved changes without mounting the GitHub token inside the coding sandbox.

Create a bounded credential

Create a GitHub token with access only to the repositories and operations you intend to use. Prefer a fine-grained token when supported by your organization. Enter it in the connector’s credential field.

The token is stored in the marketplace secret store and is not returned to the model or browser after save.

Set the repository allowlist

Add exact repositories or approved organizations to the allowlist. Repository-scoped tools require this boundary. Read tools cannot use the token to bypass it.

Start with read tools. Confirm that listing or reading an allowed repository succeeds and an unlisted repository fails.

Enable writes deliberately

Write tools are unchecked by default. Enable connector writes and select only the actions needed for issues, pull requests, branches, commits, or file updates. Keep publication behind approval.

Publish coding changes

The governed workflow separates code execution from repository credentials:

1. A coding agent works only in the selected local workspace.
2. It prepares an immutable change bundle with a trusted diff preview.
3. github.publish_change_bundle validates the bundle’s origin and base branch.
4. After approval, the connector creates a branch, commit, and pull request.

The GitHub token remains in the connector secret store and is never mounted into the coding container. Configure publication on the coding-worker profile and keep the exact publisher tool in always-ask mode.

Publication is rejected if the workspace origin does not match the requested repository or the remote base branch moved after bundle preparation. Rebase or prepare a new bundle instead of forcing the stale publication.

Recommended verification

Use a test repository to read one file, list issues, prepare a one-line change, inspect the approval diff, and publish a pull request. Confirm no direct push to the protected base branch occurs.