# GitHub Settings

GITHUBAPP_ID=12345

GITHUBAPP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\nsome-super-encrypted-key-data\n-----END RSA PRIVATE KEY-----"

GITHUBAPP_WEBHOOK_SECRET=super-duper-webhook-secret

GITHUBAPP_WEBHOOK_PATH=/webhooks/github/

# OAuth2 (optional - auto-mounts routes only when fully configured)

# Enable/disable OAuth2 routing globally (defaults to true when fully configured)

GITHUBAPP_ENABLE_OAUTH=true

# OAuth2 application credentials (from GitHub OAuth App)

GITHUBAPP_OAUTH_CLIENT_ID=Iv1.abcdef123456

GITHUBAPP_OAUTH_CLIENT_SECRET=super_duper_client_secret

# Redirect URI registered in your GitHub OAuth App settings

GITHUBAPP_OAUTH_REDIRECT_URI=http://localhost:8000/auth/github/callback

# Comma-separated scopes; defaults to "user:email,read:user" if unset

GITHUBAPP_OAUTH_SCOPES="user:email,read:user"

# Secret used to sign session JWTs (required to enable OAuth2 routes)

GITHUBAPP_OAUTH_SESSION_SECRET=change_me_session_secret

# Optional: Override OAuth2 routes prefix (default: /auth/github)

# GITHUBAPP_OAUTH_ROUTES_PREFIX=/auth/github

# OIDC (future feature; leave commented until enabled)

# GITHUBAPP_OIDC_AUDIENCE=myapp.example.com

# GITHUBAPP_OIDC_ALLOWED_REPOSITORIES=owner/repo1,owner/repo2

# GITHUBAPP_OIDC_ALLOWED_ACTORS=user1,user2

# GITHUBAPP_OIDC_ALLOWED_ENVIRONMENTS=production,staging

# GITHUBAPP_OIDC_REQUIRE_PROTECTED_REF=true