GitHub integration

Connect a GitHub account or organization to Vera and import repositories as projects — optionally letting Vera propose testing config from the repo source and keep it in sync as you push.

Requires the platform to have a GitHub App configured (QA_GITHUB_* env vars). When it isn't, none of this is visible.

App configuration (platform admin, one-time)

When creating the GitHub App (github.com/settings/apps), the post-install redirect belongs in the App's Setup URL, not the OAuth "Callback URL":

• Setup URL = <public-url>/api/public/github/callback, with "Redirect on update" ticked. GitHub sends the user here after they install or reconfigure the App. Because Vera uses the installation flow (not OAuth), leave the OAuth Callback URL field blank — pointing it at the redirect path is the classic misconfiguration that strands users on a 404 so the connect state never flips.
• Webhook URL = <public-url>/api/public/github/webhook.
• QA_PUBLIC_URL must be set so the callback can redirect the browser back to the dashboard. In production it's your deployment origin; in split-origin local dev set it to the dashboard: QA_PUBLIC_URL=http://localhost:4546 (without it, the redirect resolves against the API origin :4545, which serves no dashboard → JSON 404).

1. Connect

Settings → Integrations → Connect GitHub. You're sent to GitHub to install the Vera app; pick the repositories it may access. GitHub redirects you back and the panel shows the connected account.

• Vera stores only the numeric installation id — no access tokens at rest. Short-lived tokens are minted per request from the App key.
• Disconnecting removes Vera's access record; to fully remove it, also uninstall the app from your GitHub settings.

2. Import repositories

Projects → Import from GitHub. Search and multi-select repositories; already -imported ones are flagged. Each becomes a bare project (name + repo link, no base URL). Imports respect your plan's project limit.

3. Discover config (optional, AI)

On a GitHub-linked project: project menu → Discover from GitHub. Vera fetches a read-only source snapshot and proposes a base URL, login/auth roles, and a seed command for your review. Nothing is applied until you click Apply.

• An imported snapshot has no .env, so any credentials come only from committed code; a discovered seed command is informational (it can't run from a snapshot).
• Cloud discovery needs an API AI provider (QA_AI_PROVIDER=anthropic + ANTHROPIC_API_KEY). Local/self-host with the claude CLI works out of the box.

4. Auto-sync (optional)

On a GitHub-linked project: project menu → GitHub auto-sync: On. On a push to the repo's default branch, Vera re-reads the repo and, if the config it finds differs, surfaces a proposal banner on the project. Reviewing and applying it is always an explicit action — auto-sync never changes your config on its own.

Turn it off (default) and pushes are ignored.

Security notes

• The webhook verifies GitHub's X-Hub-Signature-256 (HMAC) before doing anything, and resolves the tenant strictly by installation id.
• Source archives are size- and file-count-capped and extracted with path- traversal and symlink guards.
• QA_GITHUB_* are platform env vars only — never editable over the API.