OpenAB Review Council (GitHub App)

Use this template when you want a webhook trigger with no copied workflow file in each target repo. PR events arrive through a GitHub App webhook, and the chair posts the verdict as your GitHub App bot after you provision its persistent volume.

It deploys a control plane plus 3 stock OpenAB Claude pods (1 chair + 2 reviewers). No per-bot setup is needed; every pod uses the same Claude Code OAuth token.

Required variables

• PUBLIC_DOMAIN: the control-plane domain, for example my-council.
• CLAUDE_CODE_OAUTH_TOKEN: from claude setup-token.
• GITHUB_WEBHOOK_SECRET: random HMAC secret, for example from openssl rand -hex 32.
• BOT_TOKEN_CHAIR, BOT_TOKEN_REV1, BOT_TOKEN_REV2: one gateway token per pod, each openssl rand -hex 32. The plane stores only their hashes and serves token = "${OABCP_BOT_TOKEN}" in /bot-config — so an unauthenticated config fetch leaks nothing (ADR 016). Use three distinct values.

GitHub App setup

1. Create a GitHub App — follow docs/install-github-app.md (SOP) or run scripts/install-github-app.sh. Required permissions: Pull requests (write), Contents (read), Commit statuses (write), Issues (write). Events: Pull requests, Issue comments. Webhook: https://my-council.zeabur.app/api/v1/github_webhooks with the same GITHUB_WEBHOOK_SECRET.
2. Install the App on the target org/repos.
3. Wire with scripts/setup-github-app.sh (sets chair App identity and OABCP_BOT_HANDLE). Use /home/node for Claude chair images or /home/agent for Kiro.

Triggers

• Automatic: PR opened, reopened, or marked ready for review.
• Manual review: an OWNER / MEMBER / COLLABORATOR comments /review on the PR.
• Follow-up questions: /ask <question> works through the webhook path. @mention also works after setting OABCP_BOT_HANDLE on the control-plane.

Steering

Every bot pod ships docs/steering/pr-review.md preloaded at /home/node/AGENTS.md (the deployment-owned steering channel). To iterate on review protocol without a plane release, edit that file on the pod or update this template's configs block — the plane never serves steering itself.

Use this GitHub App template or the PAT template, not both on one repo, or one PR event can convene two councils. The control plane does not need GITHUB_APP_ID, GITHUB_APP_INSTALLATION_ID, or GITHUB_APP_PRIVATE_KEY for this pod-local posting path.

For private repos, reviewer pods also need GitHub read access to self-fetch the PR diff. Public repos work anonymously; private repos should add read-only reviewer credentials or use the separate per-role App token path.

Quick start (non-technical): https://github.com/canyugs/openab-control-plane/blob/main/docs/install-github-app-quickstart.md Full SOP: https://github.com/canyugs/openab-control-plane/blob/main/docs/install-github-app.md