Draft
Conversation
Add GITHUB_APP_PRIVATE_KEY to the Fastify config TypeBox schema with an empty string default. The base64-encoded env var is decoded in-place on process.env before @fastify/env loads, so fastify.config receives the raw PEM string. GITHUB_APP_ID is not needed — GitHub recommends using the Client ID (already configured) as the JWT issuer.
Add GITHUB_APP_PRIVATE_KEY config
Add GitHub installation database schema and migration
…zzle-kit commands
Create Fastify plugin at backend/src/github/index.ts that initializes an Octokit App instance using GITHUB_CLIENT_ID and GITHUB_APP_PRIVATE_KEY. Credentials are mandatory — app throws at startup if missing. Exposes GitHubService interface with getInstallationOctokit() and createUserOctokit() methods. Registered in app.ts after auth plugin.
Move credential validation from the GitHub plugin to the config schema using minLength: 1 on GITHUB_CLIENT_ID and GITHUB_APP_PRIVATE_KEY. @fastify/env now rejects missing or empty values at startup.
Add GitHub service Fastify plugin with Octokit App
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Focus: GitHub App Integration
Created: 2026-02-21 15:00
Status: active
Branch: focus/github-app-integration
PR: #13
What We're Building
The GitHub integration layer for Barae. After the previous focus (GitHub App OAuth login), users can authenticate via GitHub. Now we're building the foundation that lets Barae actually work with GitHub repos: installing the GitHub App on user accounts and organizations, managing which repos Barae can access, creating new repos, and performing git operations (clone, fetch, push).
This is the bridge between "user has a Barae account with GitHub login" and "user manages their sites through Barae." Everything in future milestones (sites, templates, content management) depends on this integration layer.
Key data model: One Barae user maps 1-1 to one GitHub account. One GitHub account can access multiple app installations (personal + orgs they belong to). Barae must surface ALL installations the user's GitHub account has access to — not just ones they installed themselves.
User Flows
Flow 1: Install the Barae GitHub App (user has linked GitHub account)
Flow 1b: Install the Barae GitHub App (email-only user, no GitHub linked)
installation_idand OAuthcodeFlow 2: Discover Existing Installations
Flow 3: Sync Repo Changes
Flow 4: Create a New Repository
Flow 5: Git Operations (Foundation)
Flow 6: Handle Errors and Edge Cases
Success Criteria
Scope
In Scope
GET /user/installationsGITHUB_APP_ID,GITHUB_APP_PRIVATE_KEY(base64-encoded)POST /user/repos,POST /orgs/{org}/repos)NOT in Scope (do not build)
Pitfalls & Anti-Patterns
installation_idquery parameter from GitHub's redirect can be spoofed. Always verify by callingGET /user/installationswith the user's OAuth token before storing.gitis installed in the Docker image (apk add gitfor Alpine,apt-get install gitfor Debian). This is a one-line Dockerfile change.codeandinstallation_id. Must handle both — especially for email-only users who need their GitHub account linked.Constraints for Claude
process.envfor new config — addGITHUB_APP_IDandGITHUB_APP_PRIVATE_KEYto the TypeBox config schema, access viafastify.configinstallation_idfrom callback URLs without verifying via the user's GitHub APIdangerouslyDisableSandbox: trueforghCLI and git remote commandsTasks
42658a-github-config— Add GitHub App config env vars (GITHUB_APP_ID, GITHUB_APP_PRIVATE_KEY)85382f-github-schema— Create database schema and migration for installations and reposb61681-github-service— Create GitHub service Fastify plugin with Octokit App instance22673e-install-callback— Handle installation callback (backend route + frontend page)978668-install-discovery— Build installation discovery and sync API routesbc66cc-repo-creation— Add repository creation API routec194e9-git-operations— Build git operations service with simple-git10fdfe-frontend-installs— Build GitHub installations management UIb8aa34-frontend-repo-create— Build repository creation UI