GitHub App session summary

github-app.md

��# GitHub App � �0�0�0�0�0~0h0�0 �eBf: 2026-04-24 ## 1) zv�z - �0�0�0�0�0n00Installed GitHub Apps 0;ub�g0 `There aren't any GitHub Apps installed on this repository.` h0h�:yU0�0�0�e��\O�b�0�0�0L0��S__0�0j0D0OUL��0�x���0 - S0�0o00�0�0�0�0�0�0�n�0�0�0�0n0N�� 0�0�0�0g0B0�0�0�e��\O�bo0 Developer settings tP��Account/Organization n0 Settings �! Developer settings �! GitHub Apps �g0L�F0�_��L0B0�0�0 ## 2) gNOP�(u�aY0�0�0n0���0�0�0�0�0�0�0 � - GitHub �0�0�0�0�0��D}T~g0\O�04X�To0�0�0�0�0)jP� � - App T�0Homepage URL - Webhook �0�OF0j0�0 HTTPS n0�S�O�0�0�0�0�0�0�0����zvo0 `ngrok` I{g0�N�f � - Webhook secret��r� T�i<�(u � - �0�0�0�0�0�0�0�0��.pem�0GitHub g0 `Generate a private key` �0�[L�W0f0�0�0�0�0�0�0 � - �0�0�0(u�0�0�0�0�0��D}T~ - �0�0�0�0�0�0�{�t���t�X Ype�0�0�0�0�0�0�0�0�0�0�0�0 � - g�\)jP�n0-������_��j0 Permissions h0 Events n0�0 � ## 3) \O�bn0Am�0��!|To � 1. GitHub �! Settings �! Developer settings �! GitHub Apps �! New GitHub App - ~0_0o0: https://github.com/settings/apps/new 2. �_�����v�0eQ�R��Webhook URL / secret / permissions / events I{ � 3. \O�b�_k0�0�0�0�0�0�0�0�0�0�u�bW0f0�OX[ 4. App n0�0�0�0K0�00Install App 0g0�[a��0�0�0�0�0x0�0�0�0�0�0�0 ## 4) ��<�n0�i�����w � - App n0 `private key` g0 JWT �0\O�b��`iss`=App ID�0`exp` g'Y10�R � - JWT g0�0�0�0�0�0�0ID�0�x�� �! `POST /app/installations/:installation_id/access_tokens` g0�0�0�0�0�0�0�0�0�0�0�0�S�_ - �S�_W0_0�0�0�0�0g0 API |Ts0�QW0 ### Node��Octokit �g�\�O ```js import { createAppAuth } from "@octokit/auth-app"; import { Octokit } from "octokit"; const auth = createAppAuth({ appId: Number(process.env.GH_APP_ID), privateKey: process.env.GH_PRIVATE_KEY, installationId: Number(process.env.GH_INSTALLATION_ID), }); const installationAuth = await auth({ type: "installation" }); const octokit = new Octokit({ auth: installationAuth.token }); await octokit.request("GET /repos/{owner}/{repo}", { owner, repo }); ``` ## 5) Webhook r� T�i<����w � ```js import crypto from "crypto"; function verify(rawBody, signature, secret) { const hmac = crypto.createHmac("sha256", secret).update(rawBody).digest("hex"); const expected = `sha256=${hmac}`; const a = Buffer.from(signature || ""); const b = Buffer.from(expected); return a.length === b.length && crypto.timingSafeEqual(a, b); } ``` - Express �0�OF04X�To0 `express.raw({ type: "application/json" })` g0�un0 body �0�S�_Y0�0�0 ## 6) �Nh��v�0�0�0�0�0�0 - PR ���R�0�0�0�0 / �0�0�0�0�0 / ���R�0�0�0 - Checks API �0�Oc0_0 CI P}�gn0h�:y�0�0�0�0�0�0�0�0 - �OX[�f�e PR n0���R\O�b��Dependabot �� � - �0�0�0�0�0�0�0�0�0�0P}�g�0 Issue �S / ���w ## 7) K�(u Nn0�l�a���w � - �0�0�0�0�0�0�0�0o0N�^W0K0�0�0�0�0�0�0g0M0j0D0���_Z0�[hQk0�O�{ - �0�0�0�0 g�R�gP�k0�l�a��JWT o0�wD0�0�0�0�0�0�0�0�0�0�0�0�0�wBf�� � - Webhook o0�_Z0r� T�i<��0L�F0 - HTTPS �_������zvBfo0�0�0�0�0�0�O(u � ## �S�� - Building GitHub Apps: https://docs.github.com/en/developers/apps/building-github-apps - Authenticating as a GitHub App: https://docs.github.com/en/developers/apps/authenticating-with-github-apps