onelastcommitonelastcommit/noctra/.claude/skills/github-identity/SKILL.md

github-identity

Skill4 starsChanged 29 days agoMITView on GitHub

Use when touching how Noctra authenticates to GitHub — GITHUB_AUTH_MODE, the noctra-agent[bot] App and token service, `noctra github login`, the git credential helper, per-repo tokens, or the credentials an agent run receives.

Reads credentials

1 other project uses a version of this.

Adopted by

Most recently taken up by

ahmadAlMezaal/noctraword for word, first seen Oct 15, 2026

Other versions1 project uses a version of this.
Word for word · 1
ahmadAlMezaal/noctra★ 3100% same
Edited · 0
None found.
Wrote their own version · 0
None found.
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository11 other files it gives its agents.
- CLAUDE.mdCLAUDE.md
- agent-backendsSkill
- architectureSkill
- auto-iterateSkill
- build-and-releaseSkill
- dashboardSkill
- namingSkill
- setup-and-configSkill
- sweepsSkill
- troubleshootingSkill
- writing-good-ticketsSkill

The file

Create a free account to mount

Files

SKILL.md

GitHub identity (`GITHUB_AUTH_MODE`)

Noctra talks to GitHub either as the user whose credentials are on the host (token mode, the original behaviour) or as noctra-agent[bot], the public GitHub App owned by onelastcommit (app mode). auto (default) picks app once noctra github login has linked the host.

The App's private key never reaches the host. The token service in onelastcommit/noctra-auth (NOCTRA_AUTH_URL, default https://auth.getnoctra.dev) holds it and mints installation tokens, each scoped to one repository and one of three scopes: write (PRs/labels/replies), git (push/fetch), read (agents). Setup notes for the App itself live in deploy/github-app/.

noctra github login → device flow (user token, never stored) → Ed25519 keypair in GITHUB_AUTH_DIR (0700/0600) → POST /link
noctra run → ghauthcmd.Activate → process env: git credential helper + bot commit identity; github.SetTokenSource
  git (clone/fetch/push) → `noctra git-credential --scope git` → signed POST /token per operation
  gh (every call) → github.Command(ctx, ownerRepo, …) → GH_TOKEN for that repo (write scope, cached until 10 min before expiry)
  agent run → RunOptions.Env: read-scope GH_TOKEN + read-scope git helper

Rules

Every gh call goes through github.Command / CommandInDir, which needs the repository to pick the right installation token. In app mode it fails closed: a failed mint or unknown repository is an error, never a silent fall-back to the host's personal gh auth. A raw exec.CommandContext(ctx, "gh", …) reintroduces personal-credential use in app mode.
Git is configured purely through the process environment (GIT_CONFIG_COUNT/KEY_n/VALUE_n): an empty credential.helper first resets every helper from the user's git config (including gh auth setup-git's URL-scoped one), then Noctra's helper is added, plus credential.useHttpPath=true so git sends the repository path. ~/.gitconfig is never edited. Commit identity comes from GIT_AUTHOR_*/GIT_COMMITTER_*.
Agents get read-only credentials. Noctra does all pushing and PR work itself, so Pipeline.agentEnv hands each run a read token for the worktree's repository and a read-scope git helper. If minting fails the agent gets the sentinel GH_TOKEN=noctra-token-unavailable, because an empty GH_TOKEN would let gh fall back to the host's personal login. This guards against accidental pushes; it is not a sandbox — an agent runs as the same OS user and could read the instance key or a personal gh login from disk.
Copilot needs a user token for model access, which an installation token can't provide, so copilotEnv pins the user's token as COPILOT_GITHUB_TOKEN (read before GH_TOKEN).
The PR watcher author (github.Client.Author), the banner (GitHub as:) and doctor (github app check) all reflect the mode. GITHUB_AUTH_MODE=token forces the old behaviour even when linked.
ghauth.CanonicalString is a wire format shared byte-for-byte with noctra-auth; change both sides together (architecture Invariant 7).

Config

Env var	Default	Description
`GITHUB_AUTH_MODE`	`auto`	`auto` (app when linked), `app` (fail if not linked) or `token` (personal credentials)
`NOCTRA_AUTH_URL`	`https://auth.getnoctra.dev`	Token service used by `noctra github login`; self-hosters point it at their own deployment. The linked URL is stored with the instance
`GITHUB_AUTH_DIR`	`~/.noctra/github`	Instance ID and private key. Deliberately outside the cwd-checkout config override so a key is never written into a repository

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free