GitHub App Setup

• Self-hosted Reaudit instances that need to register their own GitHub App.
• Reaudit operations registering a fresh app for staging or for a regional deployment.

Go to github.com/settings/apps/new (or your organization's equivalent under Settings → Developer settings → GitHub Apps) and fill out the form as follows:

Repository permissions (everything else stays at No access):

• Contents: Read and write
• Metadata: Read-only (auto-selected, cannot disable)
• Pull requests: Read and write

Subscribe to events:

• Pull request

After clicking Create GitHub App, you land on the app's settings page. Collect these values:

1. App ID at the top of the page.
2. Client ID just below the App ID.
3. Generate a new client secret in the Client secrets section. It is shown only once.
4. Scroll to Private keys and click Generate a private key. A .pem file downloads.

Reaudit reads these six environment variables. Add them to your .env for local dev and to your secret store for staging or prod:

GITHUB_APP_ID=...
GITHUB_APP_SLUG=reaudit-digital-marketing-fixer
GITHUB_APP_CLIENT_ID=Iv23li...
GITHUB_APP_CLIENT_SECRET=...
GITHUB_APP_WEBHOOK_SECRET=...
GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----\n"

To convert the downloaded .pem into the single-line form Node needs, run:

awk 'BEGIN{ORS="\\n"} {print}' ~/Downloads/reaudit-*.private-key.pem

Wrap the output in double quotes and assign it to GITHUB_APP_PRIVATE_KEY.

1. Restart your Reaudit server so it picks up the new env vars.
2. Sign in to Reaudit, pick a project, and go to Tools → GitHub. The card should no longer show the “App is not configured” warning.
3. Click Connect on GitHub. You will be redirected to install the app on a repo.
4. After install, you should land back on Reaudit and see the connected repo on the GitHub card.
5. Run an audit, then click Fix in GitHub on any recommendation that has the button enabled. A pull request should appear in your repo within a few seconds.

You can rotate any of the secrets without code changes. From the GitHub App settings page:

• Client secret: Generate a new client secret, update GITHUB_APP_CLIENT_SECRET, redeploy.
• Webhook secret: Change secret, update GITHUB_APP_WEBHOOK_SECRET, redeploy.
• Private key: generate a new one and update GITHUB_APP_PRIVATE_KEY. GitHub allows multiple active keys so you can roll without downtime.