Skip to main content

​
Overview

The blacksmith.sh GitHub App is the single integration point between Blacksmith and your GitHub organization. Installing it is how Blacksmith registers runners, receives workflow events, and powers observability and [code]smith agent features; there are no PATs, deploy keys, or other standing credentials involved. You can review the exact permission set on the GitHub App listing before or after install, and choose whether the app can access all repositories or only the ones you select. The short version:
  • Running your CI needs almost nothing. Provisioning runners uses the organization self-hosted runners permission plus webhook events. It does not require access to your code.
  • Observability is read-only. Run History, Logs, Metrics, and CI Analytics read workflow run and job data from the Actions API.
  • Write access exists for two features you invoke. The Migration Wizard and [code]smith are the only features that write to your repositories. Both deliver changes through branches and pull requests, and those PRs remain subject to your existing branch protections, required checks, and review rules. The app does not have permission to change or bypass those controls.
  • No secrets, no admin. The app does not request access to secrets, variables, environments, or any administration permission, and GitHub never exposes secret values over its API in any case.

​
Repository permissions

​
Organization permissions

​
What we do not request

The Blacksmith GitHub App does not request:
  • Actions secrets, organization secrets, Dependabot secrets, or Codespaces secrets
  • Actions variables or environments
  • Administration (repository or organization)
  • Packages, deployments, or Dependabot
It cannot read secret values, change org or repository settings, or manage membership.

​
Webhook events

The app subscribes to the events it needs to provision runners and keep product features current:
  • workflow_job, workflow_run: runner pickup, run history, logs, monitors, autofix
  • pull_request, pull_request_review, pull_request_review_comment, issue_comment, issues: PR tracking, comments, @codesmith
  • check_run, check_suite: [code]smith check status and mergeability
  • push: merge-conflict detection when [code]smith is enabled
  • organization, membership, member, team, repository: keep dashboard access and repo lists in sync
  • installation, installation_repositories, installation_target: install, repo-selection, and rename lifecycle