GitHub

Setup

1. Create a GitHub OAuth App

GitHub → Settings → Developer settings → OAuth Apps → New OAuth App:

• Homepage URL: https://tappass.example.com
• Authorization callback URL: https://tappass.example.com/api/connect/github/callback

Note the Client ID and Client Secret.

2. Configure on the TapPass server

GITHUB_OAUTH_CLIENT_ID=<id>
GITHUB_OAUTH_CLIENT_SECRET=<secret>

The provider spec ships with the server (github.yaml) and auto-registers.

3. Connect

Open GET /api/connect/github (or use the dashboard) to start the OAuth flow. TapPass stores the resulting credential in the vault, scoped to your org or user.

Operations

Operation	Op group	Endpoint
list_repos	read	GET /user/repos
get_repo	read	GET /repos/{owner}/{repo}
list_issues	read	GET /repos/{owner}/{repo}/issues
get_issue	read	GET /repos/{owner}/{repo}/issues/{number}
create_issue	write	POST /repos/{owner}/{repo}/issues
create_comment	write	POST /repos/{owner}/{repo}/issues/{number}/comments
search_code	read	GET /search/code

Usage

Your agent never calls GitHub directly. When the model requests a GitHub operation as a tool call through the governed gateway, TapPass resolves the provider, fetches the connected credential from the vault, executes the operation against the GitHub API, and audits the call. Write operations (create_issue, create_comment) are gated by your tool-decision policy before anything leaves the server.

Example policy

Deny agents from opening issues in production repos:

For example, you can block create_issue on any repository whose name starts with prod-. You author rules like this in the dashboard, from a template, or in plain English — matched on the provider, operation, and arguments.

Data residency

GitHub hosts data in the US. If you require EU residency, use GitHub Enterprise Server and register a provider spec pointing api_base_url at your GHES instance (POST /api/providers).