Install Pando

GitHub

github Clone private repositories from github.com or GitHub Enterprise Server, and pick them from a list, with a GitHub App, an OAuth application, a personal access token or a deploy key.

Setup

  1. Choose how Pando signs in

    Settings method, host

  2. Create a GitHub App

    1. In GitHub, open Settings → Developer settings → GitHub Apps → New GitHub App. For an organization, start from its settings.
    2. Enter a GitHub App name and Homepage URL. Under Webhook, clear Active.
    3. Under Repository permissions, set Contents to Read-only.
    4. Choose Create GitHub App and copy the App ID. Under Credentials → Key pairs, choose New key.

    Open GitHub Apps

    Settings app_id, app_private_key · Only when method is app

  3. Install the App

    1. Choose Install App, then Install beside the owner.
    2. Pick the repositories and choose Install.

    Settings installation_id · Only when method is app

  4. Register an OAuth application

    1. In GitHub, open Settings → Developer settings → OAuth apps → New OAuth App.
    2. Enter an Application name and Homepage URL. Set Authorization callback URL to your Pando address plus /api/v1/sources/callback.
    3. Check Enable Device Flow and choose Register application.
    4. Copy the Client ID. For browser sign-in, choose Generate a new client secret.

    Open OAuth apps

    Settings client_id, client_secret · Only when method is oauth

  5. Create a personal access token

    1. In GitHub, open Settings → Developer settings → Personal access tokens → Fine-grained tokens → Generate new token.
    2. Set Resource owner to the owner. Under Repository access, pick the repositories.
    3. Set Contents to Read-only and choose Generate token.

    Open fine-grained tokens

    Settings token · Only when method is token

  6. Add a deploy key

    1. Run ssh-keygen -t ed25519 -f pando-deploy -N "".
    2. In the repository, open Settings → Deploy keys → Add deploy key. Paste pando-deploy.pub into Key and choose Add key.
    3. Paste pando-deploy below.

    Settings ssh_private_key, ssh_passphrase, known_hosts · Only when method is ssh

  7. Choose an owner

    Settings scope

Settings (14)
methodHow Pando signs inRequired
  • app GitHub App — An App installed on an organization or user. Tokens are short-lived and limited to the repositories the installation allows.
  • oauth OAuth application — Authorize as a GitHub user, with a code entered on GitHub or in the browser.
  • token Personal access token — A fine-grained or classic token with read access to repository contents.
  • ssh Deploy key — An SSH key added to one repository. Repositories are entered by address.

one of the values above · Default app

hostHost

The host repositories are on. Change it for a self-managed server.

string · Default github.com

scopeOwner

The organization or user on GitHub. Empty is every repository the credential can read; a GitHub App without an installation ID needs one.

string · For example acme

app_idApp ID

The App's ID, shown on its settings page in GitHub under General → About.

string · For example 123456 · Used when method is app

installation_idInstallation ID

The number at the end of the installation's settings address. Empty looks it up from the owner.

string · For example 45678901 · Used when method is app

app_private_keyApp private keyCredential

The contents of the .pem file GitHub downloads under the App's Credentials, Key pairs.

string · Used when method is app

client_idOAuth client ID

From the OAuth application registered in GitHub under Settings → Developer settings → OAuth Apps, with device flow enabled.

string · Used when method is oauth

client_secretOAuth client secretCredential

Needed for browser authorization. Device authorization works without one.

string · Used when method is oauth

tokenPersonal access tokenCredential

A fine-grained token with read access to contents and metadata, or a classic token with the repo scope.

string · Used when method is token

ssh_private_keySSH private keyCredential

The private half of a deploy key or access key added to the repository. Pando reads the repository with it and never writes.

string · Used when method is ssh

ssh_passphraseKey passphraseCredential

Only if the key has one.

string · Used when method is ssh

known_hostsKnown hosts

The host's public key, as ssh-keyscan <host> prints it. For github.com it may be left empty: Pando uses the keys GitHub publishes.

string · Used when method is ssh

api_urlAPI addressAdvanced

Where the host's API is, if not where Pando would look for it.

string · Default https://api.github.com for github.com, https://<host>/api/v3 for GitHub Enterprise Server

ca_bundleCertificate authorityAdvanced

PEM certificates to trust for a self-managed host on a private certificate authority, beside the system's.

string · Default The system's trusted certificates

Presets

  • GitHub.com Install a GitHub App on the organization, or create a personal access token under Settings → Developer settings.
  • GitHub Enterprise Server Enter the server's host. Its API is at https://<host>/api/v3 unless it was moved.