GitHub App private beta

First Repo Setup Guide

Install ForgeLayer on one approved repository, add forgelayer.yml, open or import a PR, inspect Review Runs, check previews, and keep human approval in control.

Private beta only. GitHub posting is disabled by default, no auto merge is enabled, no live agents run, and human review remains required.

GitHub App setup Explore RepoBrain Review Runs Pilot simulation Production architecture GitHub Checks plan

Manual verification checklist

Before the first repo demo

Install ForgeLayer on one approved repository.
Set GITHUB_ALLOWED_REPOS to the selected owner/repo.
Keep GITHUB_COMMENT_POSTING_ENABLED=false.
Add forgelayer.yml with protected paths, sensitive paths, tests, required reviewers, prompt/security review, no auto merge, and human approval.
Open or redeliver a small pull_request webhook.
Confirm repo_rules_fetched, review_run_stored, Review Status, GitHub Check Preview, and PR Comment Preview v2.
Complete human review before merge or any controlled posting test.

Sample policy

forgelayer.yml

version: 1
repo_type: nextjs_checkout_app
protected_paths:
  - app/api/payments/**
  - lib/auth/**
  - db/migrations/**
sensitive_paths:
  - lib/prompts/**
  - app/api/**/webhook.ts
test_commands:
  - npm.cmd test
  - npm.cmd run build
required_reviewers:
  - security
  - code-owner
required_security_review: true
required_prompt_review: true
required_human_review: true
required_rollback_plan: true
auto_merge: false
rules:
  - name: Payment and auth changes require human approval
    paths:
      - app/api/payments/**
      - lib/auth/**
    required_followups:
      - security review
      - tests
      - human approval

Step 01

Install ForgeLayer GitHub App

available

Use the private beta install link for the selected GitHub App.

Expected outcome: The ForgeLayer GitHub App is installed on the intended account.
Manual check: Confirm the app is installed from the approved private beta link.
Safety note: Avoid broad organization-wide installs during private beta.

Open related page

Step 02

Select one repository

available

Install on one approved test or pilot repository first.

Expected outcome: Only the intended repository is connected.
Manual check: Confirm the repo is listed in GITHUB_ALLOWED_REPOS.
Safety note: Keep the allowlist restricted to approved repos.

Step 03

Add forgelayer.yml

available

Add repo-owned ForgeLayer policy to the default/base branch.

Expected outcome: RepoBrain can fetch and apply repository policy context.
Manual check: Confirm forgelayer.yml exists and includes protected paths, sensitive paths, tests, and review requirements.
Safety note: Treat repo rules as untrusted policy input; do not include secrets.

Step 04

Configure protected paths

available

Mark auth, payments, prompts, migrations, and config as protected or sensitive.

Expected outcome: Sensitive PRs trigger stronger policy context and human review.
Manual check: Confirm protected paths and sensitive paths match the repository structure.
Safety note: Protected paths increase review attention; they do not auto-block by themselves.

Step 05

Open or import a PR

available

Create a small PR or use public .diff import for the first walkthrough.

Expected outcome: ForgeLayer has a concrete diff to review.
Manual check: Confirm the PR is small enough for the first dry-run and touches expected files.
Safety note: Do not use sensitive customer data in the first private beta walkthrough.

Open related page

Step 06

Verify webhook delivery

available

Open or redeliver a pull_request webhook from GitHub.

Expected outcome: ForgeLayer receives the webhook and processes it in safe mode.
Manual check: Confirm response fields include dry_run true and comment_posted false.
Safety note: Keep GITHUB_COMMENT_POSTING_ENABLED=false unless a controlled posting test is approved.

Open related page

Step 07

Inspect Review Run

available

Open Review Runs and inspect the safe stored summary.

Expected outcome: Reviewer sees risk, recommendation, repo rules, status, and safe metadata.
Manual check: Confirm raw diffs, raw repo rules, webhook payloads, tokens, and secrets are not shown.
Safety note: Keep the first repo setup in private beta safe mode.

Open related page

Step 08

Inspect GitHub Check Preview

available

Review the preview-only check conclusion and merge-blocking hint.

Expected outcome: Reviewer understands the future GitHub-native status model.
Manual check: Confirm the page says preview-only and no real GitHub Checks API call is made.
Safety note: Keep the first repo setup in private beta safe mode.

Open related page

Step 09

Inspect PR Comment Preview v2

available

Review the GitHub-ready markdown preview before any posting test.

Expected outcome: Reviewer sees the controlled PR comment shape.
Manual check: Confirm posting enabled is false and safe_to_post is false while posting is disabled.
Safety note: Posting is disabled by default.

Open related page

Step 10

Complete human review

available

Use human approval to decide whether the PR can move forward.

Expected outcome: Human reviewer remains in control of merge decisions.
Manual check: Confirm no auto-merge, no live agents, no autonomous workflows, and no default GitHub posting.
Safety note: Human approval is required before merge or controlled posting.

Safety notes

Keep humans in control

GitHub posting is disabled by default.
No auto merge is enabled.
No live agents or autonomous workflows are enabled.
Generic Platform Guidance: Human approval remains required before merge.
Do not put secrets, tokens, private keys, or customer data in forgelayer.yml.
Use one allowlisted repository for the first private beta setup.