GitHub Integration — Deploy From Your Repos with One Install
What does the GitHub integration do?
zop.dev connects to GitHub through a GitHub App: a 2-click install with repository-level consent and short-lived tokens. Personal access tokens and GitHub Enterprise Server are supported alternatives. The connection lists repositories and branches, clones for builds, and can redeploy on every push.
Coverage by category
Connect GitHub once and zop.dev can see the repositories you choose, list branches, clone code for builds, and redeploy automatically every time you push. The recommended path is the GitHub App, a two-click install with repository-level consent and short-lived tokens. Personal access tokens and GitHub Enterprise Server are the alternatives.
Scoped installs, short-lived tokens, HMAC webhooks
The GitHub App install flow hands zop.dev an installation scoped to exactly the repositories you select; the platform then mints short-lived installation tokens on demand (no long-lived credentials stored). Push events arrive on an HMAC-verified webhook and fan out to every deployment subscribed to that repository and branch, with delivery de-duplication. Disconnecting uninstalls the app cleanly. The PAT path supports github.com and GitHub Enterprise Server via a custom server URL.
Two clicks to install, or paste a fine-grained PAT
- Settings > Integrations > Connect GitHub.
- Approve the GitHub App install and choose repositories.
- Repos and branches appear in the deploy flow; enable auto-deploy per service to redeploy on push. PAT alternative: create a fine-grained token and paste it (add your server URL for GitHub Enterprise).
Repo listing, auto-deploy on push, and the MCP tools
Repository and branch listing, clone access for builds, auto-deploy on push, GitHub Enterprise Server support, MCP tools (connect_github, list_repositories, list_branches, set_auto_deploy, deploy_service).
Why the App rather than a token
A GitHub App grants access per repository rather than per user, and its tokens are short-lived and refreshed automatically. A personal access token carries whatever the person who created it can reach, and it keeps working after they change teams or leave, which is the failure mode worth avoiding on a build integration.
Use a PAT when the App is not an option: GitHub Enterprise Server, or an org whose policy blocks App installs.
What it can and cannot see
zop.dev reads repository metadata, branch lists and code at build time. It does not read issues, pull request contents, Actions secrets or organisation membership. Write access is limited to what deployment needs. It never pushes to your default branch.
Limits worth knowing before you connect
The App must be installed by someone authorized on the GitHub org. Webhook-based auto-deploy applies to the App flow.
GitHub integration: common questions
GitHub App or personal access token?
The App. It grants access per repository you select and its installation tokens are short-lived and minted on demand, so nothing long-lived is stored. A personal access token carries whatever its creator can reach and keeps working after they change teams or leave. Use a PAT only when the App is not an option, such as GitHub Enterprise Server or an org whose policy blocks App installs.
Can zop.dev read my issues or Actions secrets?
No. It reads repository metadata, branch lists and code at build time. Issues, pull request contents, Actions secrets and organisation membership are not read, and it never pushes to your default branch.
Does auto-deploy on push work with a PAT?
No, webhook-based auto-deploy applies to the App flow. Push events arrive on an HMAC-verified webhook and fan out, with de-duplication, to every deployment subscribed to that repository and branch.
No active rule family targets GitHub Integration — Deploy From Your Repos with One Install today. Rules that used to are retired, and retired rules publish no pages and fire no findings. Scheduling and permissions coverage are unaffected.