opschain admin github-connections update
integrations:github
Updates a GitHub connection by code or id. Pass only the fields to
change; the code and the host are immutable. A supplied
--private-key-ref re-pins the reference (resolved as it is set); an
inline key via --private-key-file / --private-key-env /
--private-key-prompt rotates the stored vault value and re-pins.
Enabling a disabled connection re-checks the integrations:github
entitlement; disabling never gates, so a lapsed estate can always
unwind. --allowed-repositories / --allowed-permissions replace the
allowed mint scope as a whole — pass both to set both, and an empty
value (--allowed-repositories "") to clear it back to unrestricted.
opschain admin github-connections update corp-github --oidc-audience https://opschain.example.com
Updated GitHub connection corp-github
Flags
| Flag | Meaning |
|---|---|
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
--display-name <name> | Human-readable connection name. |
--app-id <id> | The GitHub App's numeric id on that instance. |
--installation-id <id> | The App installation id just-in-time GH_TOKEN minting mints installation tokens for. |
--oidc-audience <aud> | The aud claim the token exchange requires on presented Actions OIDC tokens. |
--private-key-ref <ref> | Replacement secret-vault:// reference to re-pin. |
--enabled | Whether the connection serves trust policies and token exchanges (enabling re-checks the entitlement). |
--allowed-repositories <names> | Replacement repository names a github-app:// reference may mint for (comma-separated; replaces the whole allowed scope with --allowed-permissions). |
--allowed-permissions <pairs> | Replacement name:level permission pairs a github-app:// reference may mint with (replaces the whole allowed scope with --allowed-repositories). |
--private-key-file <path> | Path to a PEM file holding the App's private key (the .pem GitHub issues for the App). |
--private-key-env <name> | Environment variable holding the App's PEM private key (never the value itself on argv). |
--private-key-prompt | Prompt for the App's PEM private key without echo. |
See also
opschain docs cli/admin-github-connections-test— validating the record after a rotation.