GitHub

AlphaBase can run inside GitHub Actions to triage issues, review pull requests, and implement changes in isolated branches.

Quick Setup

Run:

alphabase github install

This bootstraps the GitHub integration flow.

Manual Setup

1. Install the AlphaBase GitHub App on your target repository/org.
2. Add a workflow file at .github/workflows/alphabase.yml.
3. Add the required provider API key as a repository secret. If you intentionally bypass the App/OIDC exchange, also set the action input use_github_token: "true" and provide GITHUB_TOKEN to the action; otherwise the App/OIDC path does not require a separate GitHub token secret.

Minimal Comment-Driven Workflow

.github/workflows/alphabase.yml

name: alphabase

on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]

jobs:
  alphabase:
    if: |
      contains(github.event.comment.body, '/alphabase')
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      pull-requests: read
      issues: read
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1
          persist-credentials: false

      - uses: XtremeHarness/alphabase/github@latest
        env:
          PROVIDER_API_KEY: ${{ secrets.PROVIDER_API_KEY }}
        with:
          model: <provider>/<model-id>
          agent: alpha-v3

The action input model is required. agent is optional and falls back to the configured Alpha/alpha-v3 primary agent when the supplied name is unavailable or is a subagent. The generated workflow uses the AlphaBase GitHub App token exchange; keep provider credentials in GitHub Secrets. The read-only workflow permissions above are for checkout/context and OIDC; the installed App must still have the repository permissions required for the branch/PR operation.

Supported Trigger Patterns

• issue comments
• pull request review comments
• pull request events
• issue events
• scheduled runs
• manual workflow_dispatch

For non-comment triggers (schedule, issues, pull_request, workflow_dispatch), provide a prompt in workflow inputs.

Security Checklist

1. Use least-privilege workflow permissions.
2. Keep API keys only in GitHub Secrets.
3. Use protected branches and required reviews.
4. Restrict which events can write to the repository.
5. Use staging repos first before production rollout.

Recommended Operational Pattern

1. Start with read-only review tasks.
2. Enable write/PR automation after confidence.
3. Add scheduled maintenance tasks later (dependency checks, TODO sweeps, docs drift checks).

See Launch Gates and Troubleshooting.