> ## Documentation Index
> Fetch the complete documentation index at: https://www.keycli.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub

> The current GitHub live slice: repo-scoped secret mutation plus narrow comment-based approval.

Use GitHub after Vercel, not before.

This is where Keycli starts to show the stronger wedge after the Vercel preview proof:

* repo-scoped live mutation
* approval in the workflow people already use
* mixed-provider plans with Vercel when every target has a valid scoped connection

## What is live

* create a GitHub connection
* test repository access
* rotate a repository Actions secret
* post approval requests into an issue or PR comment thread
* approve a plan through `/keycli approve <plan-id>` when repo, thread, and allowlist match

## What is not built yet

* full GitHub App installation flow
* broad PR automation
* deep delivery/reconciliation machinery

## Token expectations

Use a token that can:

* read repo metadata
* write Actions secrets
* write issue or PR comments when you want comment-based approval

## What to run

### 1. Start the hosted API

```bash theme={null}
npm run api:hosted
```

### 2. Create a scoped GitHub connection

```bash theme={null}
export GITHUB_TOKEN=...

curl -s -X POST http://localhost:8788/v1/connections \
  -H "authorization: Bearer $KEYCLI_TOKEN" \
  -H 'content-type: application/json' \
  -d '{
    "provider": "github",
    "label": "main",
    "authMethod": "api_token",
    "credentialRef": "env:GITHUB_TOKEN",
    "scope": {
      "provider": "github",
      "repository": "demo-org/demo-app"
    }
  }'
```

### 3. Test the connection

```bash theme={null}
export KEYCLI_GITHUB_CONNECTION_ID=conn_...
export KEYCLI_GITHUB_REPOSITORY=demo-org/demo-app

curl -s -X POST "http://localhost:8788/v1/connections/$KEYCLI_GITHUB_CONNECTION_ID/test" \
  -H "authorization: Bearer $KEYCLI_TOKEN" \
  -H 'content-type: application/json' \
  -d "{\"repository\":\"$KEYCLI_GITHUB_REPOSITORY\"}"
```

You want:

* `ok: true`
* `liveExecutionAvailable: true`

## Comment-based approval in one glance

1. create an approval-gated plan with `requestChannel: "github-comment"`
2. include repo + PR or issue context
3. provide an allowlist of approvers
4. Keycli posts the summary comment
5. an allowed human comments `/keycli approve <plan-id>`
6. Keycli verifies the context and approves the plan

## When to use GitHub

Use GitHub when you want:

* repo-scoped secret mutation
* approval in a PR or issue thread
* the strongest current mixed-provider story with Vercel

## Next reads

* [Approvals](./approvals)
* [First governed change](./first-governed-change)
* [Vercel](./VERCEL)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.