Working with other capabilities
Most of what makes GitHub worth having in the suite comes from what sits next to it. This page is the summary; each connection has its own page with the detail.
Where a connection does not exist, it is listed as such rather than left out, so you can stop looking.
#Every connection
Connects to | What you get |
|---|---|
Authentication model | Every person connects their own GitHub account; connections are per-user and per-account. There is no per-tenant GitHub App, no installation token, and no shared service token. |
OAuth scopes requested | Repo, user:email, read:org, read:user |
Consent behaviour | The authorisation step hard-codes prompt=consent, so GitHub shows a fresh consent screen on every connect, even for someone who has already authorised the app. Most UI paths also pass forceNew. |
Connect flow | - |
Where connecting is possible | Only from a GitHub-file macro on a page, or from the macro's Browse GitHub configuration modal. Both run on the `resolverAuthed` function, which is the only function that declares providers.auth: github. |
Connected account identity | Shown from GET /user: id → account id, login → display name, avatar_url → avatar. |
Connection health checking | Git-check-auth does not trust hasCredentials() alone. It calls GET /user and requires a 2xx with a JSON content type, so a revoked or expired token correctly reports as not authenticated. |
Revocation | Declared to GitHub as DELETE /applications/{client_id}/token with HTTP Basic auth and the access token in the body. It fires when the person unlinks the app in Atlassian's Connected Apps settings. |
Public file path (no connection needed) | The server converts a github.com blob URL to its raw.githubusercontent.com equivalent and tries an unauthenticated fetch FIRST, before touching any credential. This is how logged-out and unlicensed readers see public files. |
Private file path | The macro races the configured account against the anonymous fetch, then tries every other connected GitHub account concurrently, and only then offers an OAuth flow. And never for a logged-out reader. |
Network destinations | Plus direct allowances for https://raw.githubusercontent.com and images from https://avatars.githubusercontent.com. |
Server functions that talk to GitHub (nine) | Git-auth (connect), git-revoke (no-op), git-accounts (list connected accounts), git-repos (list/search repositories), git-repo (one repository), git-contents (directory listing), git-raw (file content), git-check-auth (verify connection), git-branches (list branches). |
Repository listing | Private and member repositories come from GET /user/repos with affiliation=owner,collaborator,organization_member, 100 per page, sorted by last update. Private repositories are always sorted to the top of the picker. Public repositories the person does not belong to are reachable only through GET /s |
Search fields written per page (five) | Indexing walks the page for GitHub macros and writes into the shared <hash>_capable_refs content property: git.count → <hash>_git_count ("Git File Count", number, default operator >); git.repos → <hash>_git_repos ("Git Repositories", text); git.fileTypes → <hash>_git_file_types ("Git File Types", te |
#A few things worth knowing
A connection needs both halves installed. In a standalone app most of these do not exist.
Anything that depends on search only reflects pages that have been indexed.
Published sites render Capable macros properly, which is where several of these pay off.
#Related
Better with company.
