GitHub

Connect a project to a GitHub repository and Pinwren opens one issue per feedback item — automatically or with a button — and keeps their state in step: resolve an item and its issue closes; close the issue and the item resolves. It works with github.com and GitHub Enterprise Server, with a token instead of a GitHub App, so a private or air-gapped instance needs no OAuth callback.

Connect a repositoryCopy Anchor Link

A project can have one GitHub integration (and one GitLab integration).

Creating issuesCopy Anchor Link

Send to GitHub works for any member except viewers, creates the issue right away and links it on the item. Sending the same item again returns the existing issue. If the item is already closed, the new issue is closed too.

Each issue has:

• Title: #142 Checkout button does nothing — the item's number and title (or its first line).
• Body: the reporter's text as a quote, a table with project, kind, page, browser, viewport and reporter name, and a link to the item in the dashboard ("screenshot, console and network details are there").
• Labels: the integration's labels.

Two-way stateCopy Anchor Link

Changes that come from GitHub are recorded in the item's timeline as the integration (with the issue number), notify assignees, and are not pushed back to GitHub, so nothing loops. Title, comments and labels are not synced.

ReliabilityCopy Anchor Link

Creating issues and pushing state changes are background jobs: they retry with backoff (six retries), and a GitHub outage never blocks a report or a triage change. The last error is shown on the integration — for example 401 Bad credentials (check the token) or 404 Not Found (check the repository and the token's access) — until the next success. The text after the status code is GitHub's JSON message field; a response that isn't JSON shows only the status code, and a server that can't be reached shows a category such as Could not reach GitHub: timed out. Redirects are not followed (301 redirect — use the API's final URL).

The webhook is verified with X-Hub-Signature-256 (HMAC-SHA256 of the raw body with the integration's secret). When several projects sync the same repository, only the integration whose secret verifies acts on it.

• Size and rate. Requests over 1 MB are refused with 413 before they are parsed, and each sending address may make 120 deliveries a minute (429 beyond).
• Replay protection. Each verified delivery is acted on once: Pinwren remembers its X-GitHub-Delivery id (or the body's hash) for 7 days, and a repeat is acknowledged with { "ok": true, "duplicate": true } and ignored. GitHub's Redeliver button therefore does nothing for a delivery that already arrived. If the secret leaks, rotate it with POST /api/integrations/:id/rotate-webhook-secret (workspace admin session; the tab has no button for it) and paste the new one into GitHub.

Tokens and peopleCopy Anchor Link

The token belongs to whoever created it. When they leave, an admin pastes a new one into Access token; nothing else changes. The Sync switch pauses issue creation and state sync. Disconnect removes the integration: existing issues stay in GitHub but stop syncing, and the links on items are removed.

GitHub Enterprise ServerCopy Anchor Link

Set GitHub Enterprise API URL per integration, or GITHUB_API_URL for the whole instance. Your Pinwren server must reach the GHES API, and GHES must reach Pinwren's webhook URL.

A per-integration URL is entered by a workspace admin, so it goes through Pinwren's outbound check: if your GHES resolves to a private address, the instance operator must list it in PINWREN_OUTBOUND_ALLOWLIST (for example github.example.com or 10.20.0.0/16), otherwise the connection fails with blocked: the address is private or reserved. GITHUB_API_URL is set by the operator and may point at a private address without the allowlist.