GitHub App Private Beta Setup

Guided pilot path

Start private beta onboarding

Use the onboarding checklist to move safely from setup to repo rules, review runs, PromptForge, AgentOS, Work Records, Ledger, and next-step decisions.

First repo

Setup guide

Walk one approved repo from install to forgelayer.yml, PR webhook, Review Runs, Check Preview, PR Comment Preview, and human approval.

What the app does

Controlled PR review loop

• Receives verified pull request webhooks from approved repositories.
• Fetches the PR diff and repo-owned forgelayer.yml when available.
• Applies RepoBrain policy context and generates a MergeGuard review.
• Stores safe Review Runs summaries for private beta inspection.
• Prepares GitHub Check Preview and PR Comment Preview v2 without creating real checks.

Webhook URL

Use this endpoint

Configure the GitHub App webhook URL to:

https://www.tryforgelayer.com/api/github/webhook

Keep the webhook secret server-side only. Do not paste private keys, webhook secrets, tokens, raw diffs, or raw repo rules into public notes.

Safety defaults

Safe mode first

Posting by default

disabled

Auto merge

disabled

Live agents

disabled

Autonomous workflows

disabled

Human review

required

Repo allowlist

required

Install checklist

Private beta path

1. Install ForgeLayer GitHub App on one selected repoUse the private beta app install link and avoid broad organization-wide installs.
2. Add forgelayer.yml repo rulesStart with protected paths, sensitive paths, required reviews, and test expectations.
3. Open or redeliver a PR webhookUse a small allowlisted PR and keep comment posting disabled for the first pass.
4. Review /review-runsConfirm the safe stored summary appears without raw diffs, raw rules, tokens, or secrets.
5. Check Review StatusConfirm the lifecycle status is completed, needs manual review, blocked, or failed.
6. Check GitHub Check PreviewConfirm the preview-only status model matches the merge decision.
7. Check PR Comment Preview v2Confirm the markdown preview is clear and safe before any controlled posting test.
8. Keep posting disabled until explicitly approvedUse GITHUB_COMMENT_POSTING_ENABLED=false unless deliberately testing one marked comment.

First repo checklist

Manual setup checks

• Install ForgeLayer on one approved repository.
• Set GITHUB_ALLOWED_REPOS to the selected owner/repo.
• Keep GITHUB_COMMENT_POSTING_ENABLED=false.
• Add forgelayer.yml with protected paths, sensitive paths, tests, required reviewers, prompt/security review, no auto merge, and human approval.
• Open or redeliver a small pull_request webhook.
• Confirm repo_rules_fetched, review_run_stored, Review Status, GitHub Check Preview, and PR Comment Preview v2.
• Complete human review before merge or any controlled posting test.

Sample forgelayer.yml

Repo policy starter

version: 1
repo_type: nextjs_checkout_app
protected_paths:
  - app/api/payments/**
  - lib/auth/**
  - db/migrations/**
sensitive_paths:
  - lib/prompts/**
  - app/api/**/webhook.ts
test_commands:
  - npm.cmd test
  - npm.cmd run build
required_reviewers:
  - security
  - code-owner
required_security_review: true
required_prompt_review: true
required_human_review: true
required_rollback_plan: true
auto_merge: false
rules:
  - name: Payment and auth changes require human approval
    paths:
      - app/api/payments/**
      - lib/auth/**
    required_followups:
      - security review
      - tests
      - human approval

After webhook delivery

What to verify

• repo_rules_fetched: true when forgelayer.yml exists and permissions are correct.
• review_run_stored: true when Supabase diagnostics are green.
• review_run_status shows completed, needs manual review, blocked, or failed.
• github_check_preview is present and preview-only.
• pr_comment_preview_v2.previewOnly: true.
• comment_posted: false while posting is disabled.

Not included

Still not production self-serve

• No full auth/workspace production flow yet.
• No live billing or Stripe checkout.
• No live agent execution or autonomous workflows.
• No automatic merge behavior.
• No GitHub posting unless explicitly configured with GITHUB_COMMENT_POSTING_ENABLED=true.