Connecting your first repository
You install the Nightshift GitHub App on the repositories you choose, which grants three permissions and stores no credential of yours. It takes a minute unless somebody else owns the organisation.
Settings, then GitHub, then Install. GitHub asks which account to install into and which repositories it may see. Pick the repositories rather than all of them if you have the choice: the grant names what you chose, and widening it later is one visit to the same screen.
Three permissions, and only three. Everything else stays at no access. If a security review asks, this is the table.
- Contents, read and write
- Clone the repository and push a branch.
- Pull requests, read and write
- Open the pull request.
- Checks, read and write
- Report the gate's verdict on a commit.
No credential of yours is stored. The install is a grant that lasts until you remove it. When an agent needs to clone, push or open a pull request, a token is minted from that grant for that one job, used, and allowed to expire an hour later. There is nothing here for anybody to steal that is still valid tomorrow.
Those per-use tokens are narrower than the grant. A runner’s clone token reaches the one repository its card named and carries no ability to post a check run, because a runner is a process on somebody’s own hardware and the design assumes it can be wrong.
What happens in the first five minutes. Nightshift reads the default branch to work out what the codebase is. Nothing is written, nothing runs, and no agent is dispatched: connecting a repository and working on one are separate steps, and the second needs a night window and a runner.
The things that go wrong, in the order they happen.
- Somebody else owns the organisation. GitHub sends them a request and the install waits. This is the commonest stall and has its own page.
- Installed with too few permissions. The product names the ones that are missing rather than saying it failed. Update the installation in GitHub and come back.
- The installation has no repositories. It exists but was given nothing to see. Add one to it in GitHub, or install into a different account.
- The repository cannot be read. Usually an empty default branch, sometimes an installation that does not actually cover the repository you meant.
If the app is already installed, you will hit a dead end. GitHub sends an account that has it installed to the installation’s settings page rather than through the install flow, and pressing Save there returns without the token that says which account asked. The callback refuses it, which is correct: without that token a forwarded link could attach somebody else’s installation to your account. The way out is to uninstall and install again. Nothing is lost, because an installation that was never recorded here is not connected to anything.
Taking it away is something you do at GitHub, not a row we delete. Uninstall the app, or remove a repository from the installation, and the grant is gone. Any token minted from it expires within the hour on its own.
This did not answer it? Write to us. A person reads every message.