GitHub

Anthara talks to GitHub in two ways. Each person has their own connection, and the deployment has one GitHub App. This page explains what each one is for.

	Connection	GitHub App
Who sets it up	Each person, after an admin adds the app	Whoever installs Anthara
Where	The Connections page	Deployment configuration
Used for	Work a person starts	Work that GitHub events start

The connection

A connection is your own sign-in to GitHub through an OAuth app. To create one, see Connections.

Anthara asks GitHub for two scopes:

Scope	Why
repo	Read your repositories, clone them, push branches, and open pull requests.
read:user	Read your GitHub profile.

Anthara uses your connection to:

• list the repositories you can import, on the Select Repositories page
• clone a repository when you run an assessment
• open the pull request when you activate Anthara on a repository
• give a workflow step access to GitHub, when you start the run yourself

In a workflow, a connection named GitHub reaches the agent as the environment variable GITHUB_ACCESS_TOKEN.

The GitHub App

A deployment has one GitHub App. It does two jobs:

• It sends GitHub events to Anthara, so that events can start workflows.
• It gives those workflow runs their GitHub access. No person started the run, so Anthara creates a short-lived token for the App’s installation.

The App is configured when Anthara is installed, with these settings:

Setting	Meaning
GITHUB_APP_ID	The App’s ID.
GITHUB_APP_SLUG	The App’s short name.
GITHUB_APP_WEBHOOK_SECRET	The secret GitHub signs each event with.
GITHUB_APP_PRIVATE_KEY_PATH	Where the App’s private key file is mounted.

Point the App’s webhook at the API route /github/webhooks. On a standard install the address is https://<your-domain>/api/github/webhooks.

Anthara checks the X-Hub-Signature-256 signature on every event and ignores an event it has already received.

Events that can start a workflow

A workflow with trigger.type: github lists the events it reacts to. Subscribe the App to the matching GitHub webhook event.

Event in the workflow YAML	GitHub webhook event	When the workflow runs
pull_request.opened	Pull request	A pull request is opened.
pull_request.synchronize	Pull request	New commits are pushed to a pull request. A run already in progress for the same pull request is cancelled.
workflow_run.completed	Workflow run	A GitHub Actions run finishes with a failure. Successful runs are ignored.
issue_comment.created	Issue comment	Someone comments on a pull request and mentions @anthara.
pull_request_review_comment.created	Pull request review comment	Someone leaves an inline review comment that mentions @anthara.

A GitHub trigger also needs a top-level repo, written as owner/name or owner/*, and a list of branches.

name: Review new pull requests
slug: review-new-pull-requests
repo: acme/claims-api
trigger:
  type: github
  config:
    events:
      - pull_request.opened
    branches:
      - main
steps:
  - name: review
    type: ai_task
    config:
      prompt: |
        Review pull request {{inputs.prNumber}} in {{inputs.repo}}.

@anthara comments

The two comment events only start a run when the comment text contains @anthara. Upper and lower case both match.

• Every comment that mentions @anthara starts its own run.
• Comments on plain issues are ignored. Only comments on pull requests count.
• Comments written by the App itself never start a run.
• The branches list is not used for comment events. Write branches: ["*"].

The comment text reaches the workflow as {{inputs.commentText}}, cut to 4,000 characters. Treat it as text written by a stranger.

For the full list of inputs each event provides, see Triggers.

Pull requests from workflows

A coding_task step clones the repositories it is given, pushes a branch named anthara/<short-slug>, and opens a draft pull request with the GitHub command-line tool.