GitHub

The GitHub Account connection lets apps, schedules and Chat read and control GitHub Actions and releases. It has 35 SDK entries (SDK contract version 10) in four Permission groups. Each Permission starts Ask. The host owns the URLs, the HTTP methods and the token; a call cannot supply them. The connection has no code, issue or pull request methods.

Connect

Connect a GitHub account in Connections › Accounts. Redac uses GitHub device sign-in, so Redac keeps no client secret:

1. Select Connect. Redac shows a user code, Copy code and a link to https://github.com/login/device.
2. Open the link, enter the code and approve Redac on GitHub.
3. Redac saves the account as @<login>. The token stays in the host account vault.

Cancel, expiry or denial saves nothing and shows "Sign-in ended. Connect again." You can connect more than one account. Calls take an optional connection, as in Google; resource selection gives the stable IDs.

GitHub gives access only to the repos where the owner installs the Redac app on GitHub. Redac stores no repo list. Redac cannot install the app: an owner of the account or organization installs it on GitHub. Each sign-in ends with the link Install Redac on GitHub, because an installation on one account does not reach the repos of another. The connection page has two links:

• Change repos on GitHub adds or removes repos for the Redac app installation.
• Revoke Redac on GitHub opens GitHub › Settings › Applications. Disconnect deletes the token on this computer only; GitHub revokes the grant only on that page.

GitHub gives Redac the Contents permission for releases. That permission can also change code. Redac has no code actions.

If a build has no GitHub client id, the connection shows "GitHub is not set up in this build." and Connect is not available.

Permissions

Declare each action that an app uses in the manifest actions. A read grant cannot permit a change.

github.read — Read Actions and releases (kind read, 23 entries)

Area	Entries
Repos	github.apps.listInstallationsForAuthenticatedUser, github.apps.listInstallationReposForAuthenticatedUser
Workflows	github.actions.listRepoWorkflows, github.actions.getWorkflow
Runs	github.actions.listWorkflowRunsForRepo, github.actions.listWorkflowRuns, github.actions.getWorkflowRun, github.actions.getWorkflowRunAttempt
Jobs	github.actions.listJobsForWorkflowRun, github.actions.listJobsForWorkflowRunAttempt, github.actions.getJobForWorkflowRun
Logs	github.actions.downloadJobLogsForWorkflowRun (text, the last 256 KiB)
Artifacts	github.actions.listWorkflowRunArtifacts, github.actions.listArtifactsForRepo, github.actions.getArtifact (metadata only)
Runners	github.actions.listSelfHostedRunnersForOrg, github.actions.getSelfHostedRunnerForOrg
Releases	github.repos.listReleases, github.repos.getRelease, github.repos.getLatestRelease, github.repos.getReleaseByTag, github.repos.listReleaseAssets, github.repos.getReleaseAsset

Organization runners work only when the account can see the runners of that organization on GitHub.

github.run — Re-run and cancel workflow runs (kind mutate, 5 entries): github.actions.reRunWorkflow, github.actions.reRunWorkflowFailedJobs, github.actions.reRunJobForWorkflowRun, github.actions.cancelWorkflowRun, github.actions.forceCancelWorkflowRun.

github.dispatch — Start workflows (kind mutate, 1 entry): github.actions.createWorkflowDispatch.

github.release — Manage releases (kind mutate, 6 entries): github.repos.createRelease, github.repos.updateRelease, github.repos.deleteRelease, github.repos.generateReleaseNotes, github.repos.updateReleaseAsset, github.repos.deleteReleaseAsset. createRelease publishes the release unless draft is true, and updateRelease with draft: false publishes a draft: either makes the release visible to users.

Arguments are closed objects with camelCase names: owner and repo (or org), the IDs that you observed (runId, jobId, releaseId, assetId and others) and an optional connection. Unknown fields fail validation. Results are closed projections with camelCase fields; fields that GitHub adds later are omitted. Results include the GitHub page and download links (htmlUrl, browserDownloadUrl), so an app can open them in the browser. A change that GitHub accepts with no content returns { accepted: true }. There is no automatic retry. A stopped change can already have reached GitHub: read the state again before a new retry.

const runs = await cap.call('github.actions.listWorkflowRunsForRepo', {
  owner: 'octo-org',
  repo: 'app',
  status: 'failure',
  perPage: 20,
});
const log = await cap.call('github.actions.downloadJobLogsForWorkflowRun', {
  owner: 'octo-org',
  repo: 'app',
  jobId: 123456789,
});
// log: { text, truncated, bytes }
await cap.call('github.actions.reRunWorkflowFailedJobs', {
  owner: 'octo-org',
  repo: 'app',
  runId: runs.items[0].id,
});

Limits

• Lists take perPage (at most 100) and page. List results are { totalCount, items, nextPage }; nextPage comes from the GitHub Link header, or is null. Redac does not read more pages automatically.
• The job log entry follows one redirect to a GitHub log host, without the token. It reads at most 8 MiB and returns the last 256 KiB as { text, truncated, bytes }.
• There are no ZIP downloads (run logs, artifacts) and no release file downloads or uploads.
• A release body is at most 65 536 characters. A release result has at most 100 assets.
• Dispatch inputs has at most 25 keys, and each value is at most 1024 characters.
• A request body is at most 64 KiB of JSON, so non-ASCII notes can be shorter than 65 536 characters. A larger body fails with invalid_args and "The release notes are too long." (or "The workflow inputs are too long." for dispatch inputs).

Errors

GitHub's error body is never returned, shown or logged.

GitHub answer	Error code	Message
401	unavailable	"Reconnect this GitHub account."
Other 403 (for example "Resource not accessible by integration")	denied	"Redac cannot reach this repo. Add it to the Redac app on GitHub."
404 (no such item, or a repo outside the installation)	not_found	"GitHub found no such item, or Redac cannot reach this repo. Check the name, or add the repo to the Redac app on GitHub."
403 or 429 with rate-limit headers	rate_limited	"GitHub limit reached. Try again at HH:MM."
422 validation	invalid_args	"GitHub refused the request."
Other answers, or a result that does not match the contract	unavailable	"GitHub request failed."
Device sign-in expired or denied	—	"Sign-in ended. Connect again." Nothing is saved.
No client id in this build	—	"GitHub is not set up in this build."

• Rate limits: the time comes from retry-after first, then from x-ratelimit-reset. Writes are not retried automatically.
• 401: if the account has no refresh token, the account shows Reconnect. Otherwise Redac refreshes the token before the next call.

Chat

Chat uses all 35 entries through one github_api tool. Call it with a method name and no args to read that method's argument and result schemas and its Permission. Call it again with args to execute the method once through its normal Access check. The 35 per-method tools are not in the Chat tool list. Chat treats logs, release notes, artifact names, commit messages and workflow names as untrusted content, not instructions. Re-run, cancel, dispatch and release changes need an explicit owner request in the conversation. Before a call that publishes a release, Chat tells the owner that users will see it.