Skip to content

Add workflow OAuth scope so MCP can manage .github/workflows/*.yml #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ai-nlma merged 1 commit into from
Jul 6, 2026
Merged

Add workflow OAuth scope so MCP can manage .github/workflows/*.yml #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@ GITHUB_CLIENT_ID=Iv1.xxxxxxxxxxxxxxxx
GITHUB_CLIENT_SECRET=CHANGE_ME

# Comma-separated GitHub OAuth scopes. Conservative default; bump as needed.
GITHUB_SCOPES=repo,read:org,read:user,read:project
# `workflow` is required for creating/updating files under .github/workflows/*.
GITHUB_SCOPES=repo,read:org,read:user,read:project,workflow

# --- Optional ----------------------------------------------------------------

Expand Down
2 changes: 1 addition & 1 deletion CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,4 +55,4 @@ All required env vars are validated at startup in [src/index.ts](src/index.ts):
- `API_KEY_HASH_SALT` — ≥32 chars random; drives both the token-encryption HKDF key and the tenant-id-hash salt. **Rotating this orphans every stored GitHub token**.
- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — from the GitHub OAuth App.
- `BASE_URL` — `https://github.nlma.io` in prod. Used for OAuth metadata issuer and the GitHub callback URL.
- `GITHUB_SCOPES` (default `repo,read:org,read:user,read:project`), `UPSTREAM_MCP_URL` (default `http://127.0.0.1:3060`), `GITHUB_ALLOWED_USERS` (optional CSV allowlist).
- `GITHUB_SCOPES` (default `repo,read:org,read:user,read:project,workflow`), `UPSTREAM_MCP_URL` (default `http://127.0.0.1:3060`), `GITHUB_ALLOWED_USERS` (optional CSV allowlist).
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ Copy `.env.example` to `.env` and fill in. Required:
| `GITHUB_CLIENT_ID` | From the GitHub OAuth App you register (see below). |
| `GITHUB_CLIENT_SECRET` | Same. Treat as secret. `.env` should be `chmod 600`. |
| `BASE_URL` | `https://github.nlma.io` |
| `GITHUB_SCOPES` | Default `repo,read:org,read:user,read:project`. Bump if a tool needs more. |
| `GITHUB_SCOPES` | Default `repo,read:org,read:user,read:project,workflow`. `workflow` is required to create/update `.github/workflows/*` files. Bump if a tool needs more. |
| `UPSTREAM_MCP_URL` | Default `http://127.0.0.1:3060` — the github-mcp-server docker container. |
| `GITHUB_ALLOWED_USERS` | Optional CSV allowlist of GitHub logins. Empty = anyone with a GitHub account. |

Expand Down
2 changes: 1 addition & 1 deletion src/github-oauth.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ function getEnv(name: string): string {
}

export function getGithubScopes(): string[] {
const raw = process.env.GITHUB_SCOPES ?? "repo,read:org,read:user,read:project";
const raw = process.env.GITHUB_SCOPES ?? "repo,read:org,read:user,read:project,workflow";
return raw
.split(",")
.map((s) => s.trim())
Expand Down