GitHub connection
integrations:github
A GitHub connection is one registered GitHub App against one GitHub
instance (github.com or a GitHub Enterprise Server host): the credential
root the GitHub integration's trust policies, Actions OIDC token exchange,
just-in-time GH_TOKEN minting and webhook ingestion all hang off. The App
private key never rides the record — only its secret-vault:// reference.
Served by the v2 GitHubIntegrationService (ListGitHubConnections,
GetGitHubConnection, CreateGitHubConnection, UpdateGitHubConnection,
DeleteGitHubConnection, TestGitHubConnection,
ProvisionGitHubWebhook).
GitHubConnection
GitHubConnection is one registered GitHub App connection. There is no private-key field: the record carries private_key_ref, a secret-vault:// address (a pointer, not a secret).
| Field | Type | Meaning |
|---|---|---|
app_id | integer/string | The GitHub App's numeric id on that instance. |
code | string | The code the connection is addressed by (trust policies and the exchange reference it). |
created_at | timestamp | When the record was created. |
display_name | string | The connection's display name. |
enabled | boolean | Whether the record is enabled. |
host | string | The GitHub instance host: "github.com" (the default) or a GHES host. Immutable — a different instance is a different registration, and self-hosted hosts sit behind the Enterprise-tier instance limit. |
id | string | The record's identity. |
installation_id | integer/string | The GitHub App installation id JIT GH_TOKEN minting mints installation tokens for (0: unset — JIT minting refuses by name until an administrator records it). |
last_test_at | timestamp | The most recent test verb's outcome (never key material). last_test_at is unset until the first test. |
last_test_error | string | The most recent test's failure message; "" on success (never key material). |
last_test_success | boolean | Whether the most recent TestGitHubConnection succeeded (meaningful once last_test_at is set). |
oidc_audience | string | The aud claim the exchange requires on presented Actions OIDC tokens (the audience the workflow requests its token with). Default "opschain"; set it to the instance's external URL so tokens minted for one OpsChain instance never exchange on another. |
private_key_ref | string | The canonical secret-vault:// reference the App private key lives at. |
updated_at | timestamp | When the record was last updated. |
webhook_connection_code | string | The inbound-webhook connection code GitHub webhook ingestion was provisioned onto (empty until ProvisionGitHubWebhook runs); deliveries POST to /api/hooks/. |
Related pages
opschain docs integrations-github— the component page: the App model, token exchange and webhook ingestion.opschain docs resources/github_trust_policy— the claim predicates deciding the exchange.opschain docs resources/inbound_webhook_connection— where provisioned webhook deliveries land.