On this page
GitHub integration (planned)
See the planned optional GitHub App flow, required permissions and safe hand-off; this integration is not currently available in the Cloud customer experience.
Use this planning guidance now for an inquiry and pilot proposal. Service commitments require a written agreement.
Before you start
GitHub remains optional: account access, cluster creation and OCI/YAML/Helm deployment do not depend on a repository connection. A future GitHub App may add signed installation state, short-lived installation tokens, verified webhooks and isolated builds. Those controls are a product direction, not current customer functionality.
1. Use the available release path today
- 01
Build outside the Cloud
Produce an immutable OCI image in a registry you control, or prepare a supported YAML/Helm package. Pin a digest/version and record the commit in your own change record.
- 02
Choose the browser input
In the Cloud application workflow, select the approved OCI image or YAML/Helm package and review the validation diff. No GitHub account or repository grant is required.
- 03
Follow release evidence
Use the revision, operation ID, readiness and rollback history in the browser. Keep source provenance in your own repository record until the optional integration is qualified.
2. Planned connection flow
When the optional capability is released, the intended browser sequence is: open Settings → Integrations, choose GitHub, review the ClusterPilot GitHub App name and requested repositories, authorize the selected organization/repositories on GitHub, return to the signed installation confirmation, choose a repository and branch, then save the target workspace and build policy.
| Control | Required behavior |
|---|---|
| Permission | Repository selection is explicit; the app requests only the minimum read/webhook/build permissions approved for the pilot. |
| Token | Installation tokens are short-lived, scoped and never displayed or stored in customer notes. |
| Webhook | Signed events identify repository, ref and commit; replay and signature failures are rejected. |
| Build | The service records commit SHA, build logs, scan/SBOM result and immutable artifact digest. |
3. Re-check before authorizing
- ✓Confirm the GitHub organization, repository, branch and environment are the intended ones.
- ✓Read the exact app permissions and the data retention/deletion behavior before approving.
- ✓Do not authorize a personal token, broad organization token or arbitrary webhook URL for a Cloud workflow.
- ✓Keep OCI/YAML/Helm as a fallback; disconnecting GitHub must not delete a deployed application.
4. If you need GitHub delivery now
Request the capability in the pilot inquiry and name the repository, build method, required permissions and acceptance test. Until the feature is explicitly enabled, use an approved OCI image or YAML/Helm package. Do not infer availability from planned product material or a generic repository scanner.
Deploy an application with Helm in ClusterPilot → · Cloud product status →
Use this guide within your agreed pilot scope. Kubernetes examples are not evidence of a generally available Cloud capability.