Connect GitHub

Conductor deploys apps from their Git repositories. For private repos it needs read access to clone them. The clean, reusable way is a GitHub App — set up once, it works for every repo across every org you install it on, with short-lived tokens and no per-repo deploy keys.

How it works (one App, many installations)

One GitHub App is registered by whoever runs this Conductor instance.
You install that App on your GitHub org(s).
Conductor stores the App's credentials once, then mints short-lived installation tokens to clone any repo the App can see.

1. Create the GitHub App

Go to https://github.com/settings/apps/new.
Name: Conductor. Homepage URL: your Conductor URL.
Webhook: uncheck Active for now (enable later for auto-deploy on push).
Repository permissions: Contents → Read-only (required — lets Conductor clone). Metadata is auto-selected.
Where can it be installed? "Any account" (or "Only this account").
Create GitHub App, note the App ID.

2. Generate a private key

On the App's page → Private keys → Generate a private key. A .pem downloads — keep it safe.

3. Install the App on your org(s)

Install App → choose the org → All repositories (recommended) → Install. Repeat per org.

4. Give Conductor the credentials (once)

UI (admin): Integrations → paste the App ID + private key (.pem contents) → Save → Verify access.
MCP: conductor_github set_app with app_id + private_key.

Conductor validates + stores it encrypted (redacted from the audit log).

5. Verify & deploy

conductor_github installations lists your reachable orgs. Then any app whose repo lives in an installed org just deploys — Conductor clones it with a fresh installation token at deploy time.

Alternatives (no App)

Deploy keys — a read-only SSH key per app; add the public key to the repo's Settings → Deploy keys.
Personal access token — conductor_github set_token stores a fine-grained PAT per org.

The GitHub App is the recommended path — self-serve, cross-org, and the only one that scales to multi-tenant.