The Bevia GitHub App is a read-only continuity sensor. When you install it on an account or organization and select repositories, it grants Bevia a fine-grained, revocable token to read those repos — commits, pull requests, issues, and file contents — so your work becomes part of your Bevia map.
It follows Bevia's doctrine:
- Pull-not-push. Bevia reads on its own cadence using the installation token. The app subscribes to no webhook events — it does not receive pushed events, and its webhook is inactive.
- Read-only, never writes. The app requests only
readonmetadata,contents,pull_requests, andissues. It has no write permission on anything, so it can never change your code, comments, or settings. (Sources are immutable — Bevia writes sibling artifacts, never your files.) - Provider-agnostic. GitHub is one of many surfaces Bevia observes. The app names no other tool; it's the GitHub lane of a wider sensor layer.
- Sovereign + revocable. You choose which repos it can see, and you can uninstall or narrow it at any time from your GitHub settings.
The existing GitHub connection is a personal OAuth grant (broad, tied to one user). A GitHub App is the right vehicle for:
- Organization installs — an org owner installs it once and picks repos for the whole org.
- Fine-grained, per-repo scope — read only the repos you choose, not everything the user can see.
- A Marketplace listing — a public, installable entry other teams can find and add.
| File | What it is |
|---|---|
app-manifest.json |
The GitHub App manifest — the exact name, permissions, and settings, so the app can be recreated identically (via the "create from manifest" flow or by hand). |
SETUP.md |
The step-by-step runbook: create the app, install it on the org, and submit it to the Marketplace. |
There is no Bevia engine source, no doctrine, and no secrets in this
repo — only the app's public-facing configuration and the setup runbook.
The app's private key and IDs are generated by GitHub when you create the
app and must be kept secret (see SETUP.md).