Connect GitHub through the inference shell GitHub App: install it on your account or organization, pick the repositories, and your agents and triggers act on those repositories with the app's permissions.
Overview
A GitHub App connection is one installation of the app. It is not your personal GitHub login:
- Repositories: only the ones you give the installation (all, or a selection you can change on GitHub at any time).
- Tokens: each run gets a short-lived installation token (valid one hour), minted when the run starts. Nothing long-lived is stored.
- Events: GitHub sends the installation's events to inference shell. A trigger bound to the connection runs on them. There is no webhook URL or secret to set up.
| Permission | Access |
|---|---|
| Contents, pull requests, issues | Read and write |
| Checks, commit statuses, actions, metadata | Read |
Events the app receives: check_run, issues, issue_comment, pull_request, pull_request_review, pull_request_review_comment, push, workflow_run.
For acting as yourself (your profile, every repository you can reach), connect GitHub (OAuth) instead.
Connect
- Open Vault and choose GitHub App.
- Click Connect. GitHub opens the app's installation page.
- Pick the account or organization, then All repositories or Only select repositories.
- Click Install (or Save if the app is already installed there), then Authorize. GitHub asks you to authorize the app so inference shell can confirm you have access to that installation.
- You return to inference shell with the connection listed under the account's name.
The connection belongs to the workspace you started from. Connect once per GitHub account or organization; each installation is its own connection.
Who can connect: for an organization, an owner of the organization; for a personal account, that account's user. Having access to some of the installation's repositories is not enough, because a connection acts on every repository the installation was given. A member who is not an owner can install only by request: GitHub sends the request to the owners, and an owner connects it.
Use it in a run
An app or agent that declares the github-app credential receives:
| Variable | Value |
|---|---|
GITHUB_TOKEN | Installation token, read by gh and git |
GITHUB_APP_ACCESS_TOKEN | The same token |
GITHUB_APP_ACCESS_TOKEN_EXPIRES_AT | RFC3339 expiry |
GITHUB_APP_INSTALLATION_ID | The installation |
1gh pr list --repo my-org/my-repo2git clone https://x-access-token:$GITHUB_TOKEN@github.com/my-org/my-repo.gitRun a trigger on GitHub events
Create a webhook trigger with the github source and set credential_id to the connection's id. It runs on every event of that installation; narrow it with filters on event, action and repository.full_name.
1curl -X POST https://api.inference.sh/triggers \2 -H "Authorization: Bearer inf_your_key" \3 -H "Content-Type: application/json" \4 -d '{5 "name": "review-new-prs",6 "type": "webhook",7 "action": "run_agent",8 "agent_id": "agent_abc123",9 "source_id": "<id of the github source from GET /trigger-sources>",10 "credential_id": "<id of your GitHub App connection>",11 "filters": [12 { "field": "event", "operator": "eq", "value": "pull_request" },13 { "field": "action", "operator": "eq", "value": "opened" }14 ],15 "input_mapping": {16 "action": {17 "prompt": { "value": "Review PR #{{ number }} in {{ repository.full_name }}: {{ pull_request.title }}" }18 }19 }20 }'See Triggers bound to a GitHub App connection.
Disconnect or uninstall
- Disconnect in the vault removes the connection from this workspace. The app stays installed on GitHub; other workspaces connected to the same installation keep working.
- Uninstalling the app on GitHub (or an owner suspending it) disconnects every workspace's connection to that installation. Its triggers stop running. After a suspension is lifted, the connections come back.
- Changing the installation's repositories on GitHub takes effect on the next token; there is nothing to reconnect.