GitHub delivery

Choose credentials for the operation you need to run. The authentication methods in these workflows are not interchangeable. This matrix describes repository behavior, not a hosted GitHub App service supplied by Dee Wan.

Workflow matrix

Workflow	Authentication and prerequisites	What persists
Admin sign-in and first-admin claim	Operator-configured GitHub OAuth app. Backend needs GITHUB_CLIENT_ID and secret GITHUB_CLIENT_SECRET. The callback is BACKEND_URL + /api/auth/callback/github. GitHub must return an exact primary, verified email matching an existing account or the bound first-admin address.	The GitHub account id links to the one CMS account with that normalized email. Provider access, refresh and ID tokens are not retained.
Admin Settings → Source & delivery	Operator-configured GitHub App. Backend needs GITHUB_APP_ID, GITHUB_APP_SLUG, GITHUB_APP_CLIENT_ID, GITHUB_APP_CLIENT_SECRET, GITHUB_APP_PRIVATE_KEY, plus valid BACKEND_URL and FRONTEND_URL. App callback: BACKEND_URL + /api/source/github/callback. The signed-in user needs site:infra and model read access.	The installation/repository binding persists. Repository-scoped installation tokens are short-lived and revoked after use. Do not replace this flow with a personal token.
npm run wire:github	GitHub OAuth device flow using DEEWAN_GITHUB_CLIENT_ID. Cloudflare wiring needs CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID and DEE_WAN_URL. --project is required. Secrets are sealed only after exact-commit read-back.	Repository secrets/variables are written by the authorized CLI. Device credentials stay in the process. Webhook configuration is printed, not silently saved in the CMS.
npm run backend:deliver	Device flow using DEEWAN_GITHUB_CLIENT_ID, not the admin App. Also requires the target repository, source database and output paths, Cloudflare account/token, API_BEARER_TOKEN and PUBLIC_HOSTNAME. Media transfer adds its own source/destination credentials when selected.	Generated repository and deployment remain. Device credentials are not written into git configuration or the CMS ledger. Successful verification offers a detachment plan. It does not automatically detach.
Installer’s optional GitHub connection	DEEWAN_GITHUB_APP_SLUG only enables a link to an App installation.	This is not the five-variable backend App configuration and does not replace either CLI device flow.

Permissions and refusals

The GitHub OAuth app used for CMS sign-in is separate from the GitHub App used for source delivery and from the CLI device-flow app. Its client id and secret do not authorize repository delivery.

Admin source tokens require repository contents:write, workflows:write, metadata:read. Deployment also requires actions:write, secrets:write, variables:write. Selection is checked against the installed repository. If the backend App configuration is missing, the request is refused with github_app_not_configured. There is no device-flow fallback in this UI.

The separate build-webhook credential printed by wire:github is a fine-grained token for that repository with Contents: read and Actions: write. Do not reuse the device token as the stored webhook secret. Review and save the printed configuration under Source & delivery → Advanced — build webhook and deployment with an authorized CMS session.

Managed delivery of a local commit

Generate the Astro website and backend locally first. Hosted generation still refuses with source_build_runtime_unavailable. Connect the source GitHub App to the intended private adopter repository, then run:

npm run wire:github -- --repo owner/site-source --project ./generated/site --managed --operation delivery-20260920-1

Use a new stable operation id for a new delivery. The signed-in person needs site:infra, site:deploy and read access to every generated model. Supply DEE_WAN_SESSION_COOKIE in the CLI environment and DEE_WAN_SESSION_ORIGIN as the CMS frontend origin. DEE_WAN_URL is the backend origin. The CLI sends the session only to that CMS origin. These values do not go into the generated project.

Before changing the repository, determine CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_TOKEN, API_BEARER_TOKEN, DEE_WAN_HOSTNAME (the deployed backend hostname), ASTRO_ORIGIN (the expected public HTTPS Astro origin), and the selected artifact authentication credentials described below. GitHub authorization does not grant Cloudflare access. The generated site must have its preview bridge configured for the intended CMS public API before committing.

The CLI commits and pushes through Git, reads back the full remote commit, and verifies its manifest. Only then can it seal secrets to the adopter repository. The CMS records the site, operation, attempt, source version and exact commit, with only the build token’s identifier and HMAC. Cloudflare credentials never enter a CMS request, ledger, manifest or generated file. The deployment dispatch carries the exact commit. The workflow checks out and verifies that commit before running its deployment script.

Keep the operation id after an interruption. Add --resume only after the previous CLI process has stopped, while the operation is still preparing secrets. This rotates and revokes its previous build credential before continuing. Once dispatch has begun, use --reconcile with the same operation id. Reconciliation reads the matching GitHub run and never dispatches. A missing, duplicate or unreadable run stays locked as an unknown outcome. Do not invent another operation to bypass that lock. CLI success means GitHub confirmed the run. It does not mean deployment or preview activation finished.

Only the managed workflow reports completion, using its existing build token and the bound operation, attempt, commit and deployed Astro origin. The repository-only workflow has no CMS callback. Completion stores the origin as unverified. A conflicting completion replay is refused, while an exact replay can return the recorded result. Under Source & delivery, a signed-in person with site:settings chooses a readable saved item and runs preview verification. Only the reported candidate may be activated through this action. A failed completion or proof keeps the previous active renderer target.

Real GitHub installation/callback authority, private repository adoption, secret sealing and revocation, Actions reconciliation, Cloudflare deployment, DNS, deployed callbacks and preview proofs remain external acceptance gates.

Evidence and next task

The authorities are backend/src/api/source-delivery.ts, backend/src/lib/github/credentials.ts, scripts/github-start.ts, scripts/github.ts, scripts/exit-start.ts and scripts/install-web.ts. Before using the CLI, read its actual usage output. This page does not supply or create credentials. Continue with installation or detachment.

Disconnect GitHub sign-in

Choose Account security from your identity menu to inspect and unlink your own GitHub sign-in connection. Confirmation names GitHub and warns that every CMS session will end, including the current one. The operation is atomic and refuses removal if no active superadmin would retain an enabled, configured, usable sign-in method. It does not change the separate source-delivery GitHub App installation or CLI credentials.

See account security and the lead-owned real-provider acceptance procedure. Local fixtures are not evidence of a successful GitHub callback.

Artifact sign-in credentials

Optional Better Auth in generated backends is a separate identity system. The artifact GitHub OAuth application uses <ARTIFACT_ORIGIN>/api/auth/callback/github. It is separate from the CMS OAuth application, source-delivery GitHub App and CLI device authorization. Select methods under Source & delivery. Supply credentials explicitly for the target, and only for the selected providers. Actions secret names prefix runtime names with ARTIFACT_, including ARTIFACT_GITHUB_CLIENT_ID and ARTIFACT_GITHUB_CLIENT_SECRET. Delivery creates a fresh artifact auth secret, seals values to the target public key and preserves existing target secrets without rotating them. No CMS identity, password or provider credential is copied.

---

Unreleased / pre-MVP; no stable version
Source revision: fe23db481c422b40e317b92fc98116b4c0c26a87 (modified checkout)
Build date (UTC): 2026-10-18T09:22:34.630Z
Upgrade target: unavailable: modified checkout. Release notes