feat(search): add GitHub installation indexing

[icecrasher321]

Summary

• Add GitHub App installation indexing for organization Search through the existing credential and connector paths. Admins select a verified installation; each reader connects GitHub to establish their own access.
• Verify the requested repositories before loading indexed results, documents, or chunks. Search authorizes bounded ranked candidates and lists use bounded batches under the existing ACL predicate. Bind sources to immutable repository IDs and deny revoked, suspended, transferred, or mismatched access.
• Add installation setup and provider configuration refresh to the existing settings UI. Document the customer GitHub Search flow and keep App registration and server configuration in the existing self-hosting guide.

Type of Change

• New feature
• Bug fix
• Documentation

Testing

• 2,219 knowledge/GitHub tests, 30 organization-provider UI tests, and 11 disposable PostgreSQL/Redis end-to-end integration tests passed.
• Integration coverage exercises credential resolution, scoped installation tokens, indexing, reader observations, search/document/chunk reads, URL lookup, counts, and pagination. It covers an organization with 106 installation sources, a stalled repository check alongside a successful one, user revocation, App repository removal, and installation suspension.
• App and docs type-checks, lint, all 46 repository audits, docs manifest/MDX checks, and diff checks passed.
• Regenerated the settings import-graph baseline for the existing managed OAuth validation path; registry enforcement and tolerances are unchanged.
• Live GitHub OAuth and UI testing follows deployment. No database migration is required.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 9, 2026 11:43pm UTC

[greptile-apps]

Greptile Summary

This PR adds GitHub App installation-backed indexing for organization Search while retaining per-reader GitHub authorization.

• Adds authenticated installation discovery and connection APIs, encrypted installation bindings, and repository-scoped installation tokens.
• Binds sources to provider-verified repository IDs and performs live reader and installation checks before returning indexed content.
• Extends search, document, chunk, count, tag, and pagination paths to authorize bounded candidate batches.
• Adds organization setup UI, provider visibility and refresh behavior, extensive tests, environment examples, and self-hosting/user documentation.

Confidence Score: 5/5

The PR appears safe to merge; no new actionable defects remain, and both previously reported access failures are manually resolved and fixed in the current code.

The current implementation authorizes bounded candidate sets without the former 100-source cutoff and retains completed repository grants when another source reaches its independent deadline. The changes since the previous review primarily relocate and clarify documentation plus stabilize an asynchronous test assertion, with no resulting correctness or rule-compliance issue.

Important Files Changed

Filename	Overview
apps/sim/lib/knowledge/access/github-installation.ts	Implements bounded, per-source live GitHub authorization and preserves completed grants when another source stalls.
apps/sim/lib/knowledge/search/queries.ts	Ranks opaque candidates before live authorization, then hydrates only results allowed by the full predicate.
apps/sim/lib/knowledge/read-access.ts	Streams bounded connector authorization batches for document lists, counts, tags, and bulk operations.
apps/sim/lib/oauth/github-installation.ts	Validates App configuration, installation ownership and state, and mints repository-scoped installation tokens.
apps/sim/lib/knowledge/application/github-installation-source.ts	Restricts installation indexing to organization member-mode Search and binds sources to provider-attested repository identities.
apps/sim/app/api/knowledge/github/installations/route.ts	Exposes authenticated, rate-limited installation list/connect endpoints with safe response projections.
apps/docs/content/docs/platform/self-hosting/integrations-oauth.mdx	Documents GitHub App registration, permissions, environment configuration, and replacement procedure.

Sequence Diagram

sequenceDiagram
  participant Admin
  participant Sim
  participant GitHub
  participant Index
  participant Reader

  Admin->>Sim: Connect personal GitHub account
  Sim->>GitHub: List installations administered by user
  Admin->>Sim: Select installation and repository
  Sim->>GitHub: Verify installation and immutable repository ID
  Sim->>Index: Index through repository-scoped installation token
  Reader->>Sim: Search or open indexed content
  Sim->>GitHub: Verify reader repository access and installation state
  GitHub-->>Sim: Current authorization result
  Sim->>Index: Load content under full ACL predicate
  Index-->>Reader: Return only authorized content

Loading

_{Reviews (3): Last reviewed commit: "fix(search): clarify public setup docume..." | Re-trigger Greptile}

[icecrasher321]

@greptile

[icecrasher321]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@icecrasher321 I have started the AI code review. It will take a few minutes to complete.

[icecrasher321]

@greptile

[icecrasher321]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@icecrasher321 I have started the AI code review. It will take a few minutes to complete.