GitHub and Native Git
Configure GitHub for repository operations, Engineering source delivery, approvals, and branch protection.
The GitHub integration provides two separate capabilities:
- GitHub tools handle repository metadata, issues, pull requests, workflows, security, and other GitHub operations.
- Native Git lets Engineering tasks clone, fetch, pull, inspect, commit, and deliver repository source through ordinary HTTPS Git commands.
Oblive stores the personal access token encrypted in the backend. Agents receive a short-lived execution capability, never the token.
Create the Token
Prefer a fine-grained personal access token with a short expiration and access only to the required organizations and repositories.
Grant:
- Metadata: Read;
- Contents: Read for clone, fetch, and pull;
- Contents: Read and write when Engineering must push branches; and
- only the additional permissions required for the selected GitHub tools.
Do not use a broadly scoped classic token when a fine-grained token can represent the workflow.
Protect Branches in GitHub
Configure GitHub branch protection or rulesets for important branches. Disable force pushes and add the organization’s required review or status-check rules.
Oblive rejects tag pushes, branch deletions, and unsupported push options. GitHub remains the hard, graph-aware authority for rejecting non-fast-forward updates and protected-branch violations.
Choose a Permission Mode
| Permission Mode | GitHub Tools | Engineering Native Git |
|---|---|---|
| Read-only | Provider-enforced read operations. | Clone, fetch, pull, and repository inspection. |
| Ask before writes | Selected consequential tools stage an approval. | Ordinary branch pushes from an Engineering execute task stage an approval. |
| Autonomous | Selected consequential tools may execute directly. | Ordinary branch pushes from an Engineering execute task may execute directly. |
Native Git is available only to Engineering task runs. Growth may use its granted GitHub tools but does not receive the native Git transport.
Task Behavior
| Task Mode | Native Git Behavior |
|---|---|
plan, research, review | Repository reads are permitted when GitHub is granted. No source push. |
execute | Repository reads are permitted. A verified ordinary branch push requires Ask before writes or Autonomous. |
verify | GitHub and other integration capabilities are unavailable. Verification uses retained evidence only. |
Engineering uses https://github.com/<owner>/<repository>.git. SSH, GitHub Enterprise, Git LFS,
tags, remote deletions, force pushes, and push options are outside the current native Git contract.
One push may update at most 20 branches and carry at most 100 MiB. Repository-local rules may be stricter.
Approvals and Reconciliation
A branch push uses Oblive’s typed action lifecycle:
- The exact Git request is validated and staged privately.
- The action executes immediately or waits for organization approval.
- When approval is required, the task stops and the action appears for review. Do not ask the agent to retry the push.
- Approval executes the already staged request. An uncertain provider result enters reconciliation and must be checked before any further push.
See Access and Consequential Actions for the shared action lifecycle.
Troubleshooting
Clone or fetch is denied
Confirm the token can access the repository, includes Contents read permission, the integration is enabled, and Engineering has a profile grant.
Push is denied
Confirm the integration uses Ask before writes or Autonomous, the token includes Contents write
permission, the task is in execute, and the target branch permits the update.
Git reports non-fast-forward
The agent will not force the push. Inspect the newer remote branch and decide how the work should be integrated through an ordinary verified change.
The task is waiting after push
Review the pending action. If the outcome is uncertain, verify the branch in GitHub before resolving the reconciliation item. Never create a second push merely because the first response was unclear.