GitHub

Rivets connects to GitHub through its own GitHub App. The app is the only GitHub credential Rivets uses: workers never read your personal access tokens, SSH keys, or git credential helpers. Connecting the app lets tasks clone, push, open pull requests, follow checks, and merge.

Connect GitHub

Only organization owners can connect GitHub and add repositories.

On Home, choose Connect repository. This opens the Repository tab of the New task dialog. You can also start from Repos or from Settings › Integrations › GitHub.
Choose Connect GitHub. GitHub asks you to install the Rivets GitHub App and authorize it. Choose the account or organization and the repositories to grant.
Back in Rivets, the Repos page says GitHub connected. Choose a repository below. Choose Connect next to a repository. Rename lets you give it a different name in Rivets first.

Once GitHub is connected, the Repository tab of the New task dialog lists the granted repositories too. Pick one and choose Add repository. The dialog switches to Task with that repository selected, so you can start work in it straight away.

The Mac and iOS apps show the same GitHub card under Settings › Integrations. Once connected, Manage in GitHub opens the installation on GitHub. To grant more repositories later, change the installation’s repository access there, then add them in Rivets.

Permissions

The app requests these repository permissions:

Permission	Access	Why
Contents	Read and write	Clone repositories, push task branches, and merge.
Pull requests	Read and write	Open, update, and merge pull requests, and read reviews.
Metadata	Read-only	Required by GitHub for every app.
Checks	Read-only	Show check runs in the Checks tab.
Commit statuses	Read-only	Show commit statuses in the Checks tab.

Rivets does not request the Workflows permission. A task whose commits change files under .github/workflows cannot push its branch: GitHub rejects the whole push, and Rivets says which files caused it. Remove those changes from the task, or push the branch yourself with your own GitHub credentials.

If Checks or Commit statuses has not been approved on an installation, the Checks tab reports checks as unavailable. Everything else keeps working.

How credentials reach a worker

A worker never holds a long-lived GitHub credential.

When a job needs GitHub, Rivets issues a short-lived installation token for that one repository, with only the permissions the job needs.
The worker hands it to each git command through a local credential helper over a Unix socket. The token is never written to disk and never appears in a process listing.
The worker’s own git identity files set the commit author to the person who triggered the work.

Webhooks

The app subscribes to pull request, check run, check suite, commit status, and push events. These keep every client’s Checks tab current and let Rivets archive a task when its pull request is merged on GitHub. If a webhook is delayed or missed, clients recover by polling.

Repositories without GitHub

On the Repos page, owners can also choose Add repo to add a repository by a Public or file URL, with a name and default branch. The URL must be https:// or file://, without credentials in it. SSH URLs are not supported, and repositories on github.com must be connected through the GitHub App instead.

Workers clone these without credentials, and their own git credential helpers are turned off. Tasks work as usual and can commit, but pull requests, checks, and merging need the GitHub App.

Who sees which repositories

Connecting a repository makes it available to the organization. Which members can use it is controlled by teams. A member sees a repository only when one of their teams grants it. Owners see every repository. See Teams and permissions.

Limits

Tasks publish to a branch of the same name on origin in the same repository.
Pull requests from forks cannot be checked out as a start point, and publishing to forks or alternate remotes is not supported.
Rivets cannot push changes to .github/workflows. See Permissions.