Use the GitHub app in Google Chat

This outlines the distinct characteristics and operational models of GitHub apps and OAuth apps, which serve as primary mechanisms for third-party services to integrate with and access GitHub resources. A comprehensive understanding of these differences is critical to maintain an optimal security posture within an organization.

1. Comparative analysis: Key distinctions

The fundamental differences between the 2 models reside in the identity used for access (the Principal) and the mechanism that governs resource authorization.

Attribute	GitHub app (Recommended sign in)	OAuth app (Legacy sign in)
Principal identity	Acts as an independent Application Identity, separate from any user, or on behalf of the authorizing user, depending on the use case.	Acts on behalf of the authorizing user, inheriting their privileges.
Authorization model	Fine-grained permissions (Recommended): Utilizes the Principle of Least Privilege, allowing access to specific repositories and resource types. For example: Read access for metadata only.	Broad scopes: Access is defined by wide scopes like granting access to all resources visible to the authorizing user.
Credential longevity	Short-lived tokens: Access tokens possess a limited lifespan (typically 1 hour) and require frequent renewal, significantly mitigating risk in the event of compromise.	Long-lived tokens: Access tokens persist until manually revoked by the user, representing a prolonged exposure risk.
Installation requirement	Must be installed by an Administrator or Organization owner, establishing a formal link to the account or organization and authorized by the user for use cases where the app is acting on behalf of the user.	Must be authorized by an individual user, linking access directly to that user's identity.

For more comprehensive documentation, refer to Differences between GitHub Apps and OAuth apps.

2. Recommendation

Based on security best practices, the GitHub App authentication mechanism is recommended for all third-party and organizational integrations. This model enforces the Principle of Least Privilege and employs robust, time-limited credentials, thereby maintaining a higher standard of security and operational stability compared to the delegated authority model of OAuth Apps.

Install the Google Chat App for GitHub repositories.

Tip: You need to set up notifications in each space where you add the app. The app sends notifications to all spaces where it's a member.

Migrate from OAuth app (Legacy) to GitHub app (Recommended)

To migrate your current connection from the older OAuth app authentication method to the recommended GitHub app method:

1. Open the Chat app .
2. Open a direct message or space with the GitHub app.
3. In the message field, tap Google Workspace tools .
4. In the command list, select GitHub Reauthorize.
5. To complete the migration and reauthorization process, follow the on-screen instructions in the Chat dialogue.

Use the GitHub app in spaces

To use the app in spaces, you need to @mention or /mention the app in each message and in replies to the messages from the app.

The @mention or /mention confirms you've sent the message to the app and not to others in the space.

1. Open the Chat app .
2. In a space, enter @github or /github followed by the command.
   • When you mention @github or /github, the message is sent to the app and not to others in the space.

GitHub app

To set up real-time notifications in spaces:

1. In your browser, go to GitHub profile settings.
2. Under “Integrations,” tap Applications Authorized GitHub apps.
   • After you connect the GitHub app in Google Chat, your list of authorized apps shows “Google Chat.”
3. Install the Google Chat App for GitHub repository.
   • Or, you can request installation from the organization/repository owner.
4. Wait until installation is complete.
5. In Google Chat, open a direct message or space with the GitHub app.
6. In the message field, to create a subscription, enter: /github_subscribe [organisation/repo] or /github_settings.

OAuth app

To set up real-time notifications in spaces, you must:

• Be an organization owner of the proposed repository.
• Authorize the app on the GitHub organization.
  1. In your browser, go to GitHub profile settings.
  2. Under “Integrations,” tap Applications Authorized OAuth apps.
     • After you connect the GitHub app in Google Chat, your list of authorized apps shows “Google Chat.”
  3. Grant the app access to the organization you want to access.

1. In the message field, enter: /github_settings.
2. To edit your repository notifications settings, tap Notification settings.
3. To filter the notifications, next to each notification type, tap the down arrow .
   • It displays additional options to filter notifications.
4. Check the boxes for the notifications you want.
5. Tap Save.

To get mentioned in scheduled reminders, you must’ve connected your Google Chat account to the GitHub account.

1. In the message field, enter: /github_settings.
2. To connect your account:
   1. In the pop-up, tap Configure access Sign in to GitHub.
   2. Sign in to your GitHub account.
   3. Authorize the app.
3. In the message you receive from the GitHub app, select Schedule reminders for your team.
4. In the pop-up:
   1. Tap Create new reminder.
   2. Configure the reminder settings.
   3. Tap Save.

On the repository from where you want to receive reminders, verify the installation of the Google Chat App for GitHub.

Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.