# GitHub Integration — Deploy From Your Repos with One Install

> Install the GitHub App to browse repos and branches, deploy services, and auto-deploy on push. PAT and GitHub Enterprise Server also supported.

Source: https://zop.dev/integrations/github
Updated: 2026-08-20

---

## Common questions

### GitHub App or personal access token?

The App. It grants access per repository you select and its installation tokens are short-lived and minted on demand, so nothing long-lived is stored. A personal access token carries whatever its creator can reach and keeps working after they change teams or leave. Use a PAT only when the App is not an option, such as GitHub Enterprise Server or an org whose policy blocks App installs.

### Can zop.dev read my issues or Actions secrets?

No. It reads repository metadata, branch lists and code at build time. Issues, pull request contents, Actions secrets and organisation membership are not read, and it never pushes to your default branch.

### Does auto-deploy on push work with a PAT?

No, webhook-based auto-deploy applies to the App flow. Push events arrive on an HMAC-verified webhook and fan out, with de-duplication, to every deployment subscribed to that repository and branch.

Connect GitHub once and zop.dev can see the repositories you choose, list branches, clone code for builds, and redeploy automatically every time you push. The recommended path is the GitHub App, a two-click install with repository-level consent and short-lived tokens. Personal access tokens and GitHub Enterprise Server are the alternatives.

## Scoped installs, short-lived tokens, HMAC webhooks

The GitHub App install flow hands zop.dev an installation scoped to exactly the repositories you select; the platform then mints short-lived installation tokens on demand (no long-lived credentials stored). Push events arrive on an HMAC-verified webhook and fan out to every deployment subscribed to that repository and branch, with delivery de-duplication. Disconnecting uninstalls the app cleanly. The PAT path supports github.com and GitHub Enterprise Server via a custom server URL.

## Two clicks to install, or paste a fine-grained PAT

1. Settings > Integrations > Connect GitHub.
2. Approve the GitHub App install and choose repositories.
3. Repos and branches appear in the deploy flow; enable auto-deploy per service to redeploy on push. PAT alternative: create a fine-grained token and paste it (add your server URL for GitHub Enterprise).

## Repo listing, auto-deploy on push, and the MCP tools

Repository and branch listing, clone access for builds, auto-deploy on push, GitHub Enterprise Server support, MCP tools (connect_github, list_repositories, list_branches, set_auto_deploy, deploy_service).

## Why the App rather than a token

A GitHub App grants access per repository rather than per user, and its tokens are short-lived
and refreshed automatically. A personal access token carries whatever the person who created it
can reach, and it keeps working after they change teams or leave, which is the failure mode
worth avoiding on a build integration.

Use a PAT when the App is not an option: GitHub Enterprise Server, or an org whose policy
blocks App installs.

## What it can and cannot see

zop.dev reads repository metadata, branch lists and code at build time. It does not read issues,
pull request contents, Actions secrets or organisation membership. Write access is limited to
what deployment needs. It never pushes to your default branch.