GitHub App (Self-hosted)

To enable GitHub repository onboarding on a self-hosted Chainloop instance, create a GitHub App and provide its credentials to the Chainloop backend through Helm chart values. This is a one-time, operator-level setup step — once configured, your users connect their GitHub organization from the Chainloop UI following the Connect GitHub & GitLab flow.

Create the GitHub App

Create the App on GitHub

Follow GitHub’s guide to creating GitHub Apps to register a new App under your GitHub organization (or personal account, for testing).

Grant the required permissions and events

Configure the App’s repository and organization permissions and subscribe to the webhook events Chainloop needs. See the GitHub permissions reference for the full, up-to-date list of scopes and events per feature.

Collect the App ID

On the App’s settings page, note the App ID shown near the top. You’ll set this as appId.

Generate a private key

Under Private keys, click Generate a private key. GitHub downloads a PEM file — you’ll set its contents as privateKey.

Note the app slug

The App’s public URL is of the form https://github.com/apps/<app-slug>. Copy the <app-slug> segment — you’ll set this as appSlug.

Set a webhook secret

Under Webhook, set a Secret — a random string used to verify that incoming webhook requests genuinely came from GitHub. You’ll set this as webhookSecret.

Chart values

Provide the App’s details to the Chainloop backend under backend.githubApp in your Helm chart values:

backend:
  githubApp:
    appId: 123456
    privateKey: |
      -----BEGIN RSA PRIVATE KEY-----
      ...
      -----END RSA PRIVATE KEY-----
    appSlug: my-chainloop-app
    baseUrl: https://github.com
    webhookSecret: ""

Key	Description
`appId`	GitHub App ID.
`privateKey`	PEM-encoded RSA private key for signing App JWTs.
`appSlug`	App slug from the App’s public URL (also acts as the enable flag; the config renders only when set).
`baseUrl`	Optional, defaults to `https://github.com`.
`webhookSecret`	Shared secret for verifying GitHub webhook signatures (HMAC-SHA256); required for webhook event processing.

GitHub Enterprise Server: set baseUrl to your GHES URL — all features are supported the same way as on github.com.

These values apply to both the OSS chart (chart: platform) and the Enterprise chart (chainloop-ee) — the value paths are identical.

Getting Started

Concepts

Guides

References

Misc

Create the GitHub App

Chart values

​Create the GitHub App

​Chart values

Create the GitHub App

Chart values