What it is
Valet acts on GitHub as a GitHub App installed on the repositories agents may work in. For each job it asks GitHub for a short-lived installation token narrowed to that job's repositories and its role's permissions. The token stays inside Valet: agents never see it.
Permissions
| Permission | Level | Used for |
|---|---|---|
| Contents | Read & write | Cloning, and pushing to an agent's own agent/<job>/ branch |
| Pull requests | Read & write | Reading, opening and commenting on pull requests |
| Issues | Read & write | Reading and commenting on issues (triage) |
| Checks | Read | Reading CI results |
| Metadata | Read | Required by GitHub |
It never asks for Administration, and it is never on a ruleset's bypass list: GitHub's own branch protections still apply to everything it does, so a merge to a protected branch always needs a person's review.
Your data
Valet is self-hosted. It runs on your machine or server, keeps its audit log and secrets there, and talks only to GitHub and the other services you configure. It sends nothing to its authors: no telemetry, no analytics, no accounts.
Setting it up
Follow docs/github-app.md to create and install the App, and docs/github-rulesets.md for the branch protections that back it up.
Support
Questions and problems: github.com/xcwds/valet/issues.