GitHub App

The server authenticates to GitHub as a GitHub App installation, not gh or a PAT. That gives a container its own narrow, short-lived access to only the repositories a person selects. The same GitHub App can also provide Continue with GitHub for the human login flow.

One-time setup:

1. Create the App — github.com → Settings → Developer settings → GitHub Apps → New GitHub App. Set the Homepage URL to https://navidiff.com, Callback URL to https://app.navidiff.com/api/auth/callback/github, and Setup URL to https://app.navidiff.com/github/installed. Under Identifying and authorizing users, enable Request user authorization (OAuth) during installation. Under Account permissions, grant Email addresses: Read-only so GitHub can identify people whose email is private. Webhook: uncheck "Active" (nothing here listens for events). Repository permissions: Pull requests: Read & write, Checks: Read-only, Contents: Read-only, Metadata: Read-only (added automatically). Save, note the App ID.
2. Generate a private key on that same page — downloads a .pem.
3. Configure the server — set GITHUB_APP_ID, GITHUB_APP_SLUG, GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, and either GITHUB_APP_PRIVATE_KEY_PATH (path to the .pem) or GITHUB_APP_PRIVATE_KEY (its contents). GITHUB_APP_INSTALLATION_ID is optional — left unset it's resolved from the repo; set it only if the same App is installed on more than one account and the lookup is ambiguous.
4. Install it — sign into Navidiff with GitHub, then use Workspace → Install on GitHub. Pick the account and selected repositories; GitHub returns to Navidiff when the install is complete.

GET /preflight's github app line confirms the App ID, key, and install all agree — with a specific reason (GITHUB_APP_ID not set, App not installed on owner/repo, …) if not.

var
GITHUB_APP_ID	the App ID from step 1
GITHUB_APP_SLUG	public slug used for the in-app installation URL
GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET	the same App's user-login Client ID and secret
GITHUB_APP_PRIVATE_KEY_PATH / GITHUB_APP_PRIVATE_KEY	the App's private key, as a path or its raw contents
GITHUB_APP_INSTALLATION_ID	only if the App is installed on more than one account

In Docker, set GITHUB_APP_PRIVATE_KEY_PATH_HOST in .env to the .pem's host path; the compose file mounts it read-only and points the container's own GITHUB_APP_PRIVATE_KEY_PATH at the mounted copy.