GitHub provider reconciliation

Connect one GitHub repository webhook in endpoint settings. Its target must match the endpoint’s ingest URL. Configure GitHub signature verification in quarantine mode and at least 72 hours of deduplication first.

A fine-grained token needs repository Webhooks read permission for comparison and write permission for redelivery. Credentials are encrypted with an independent application key, never returned, and expire after 90 days. Disconnect removes the stored credentials; active jobs then stop. Credential replacement does not extend the retention of event payloads.

Compare only reads one page of up to 50 provider deliveries. It does not send webhook requests. A missing candidate has no retained, verified acceptance receipt in this organization and endpoint. Before a future rollout, backfill the receipt index for older accepted events; missing is not proof that a business action never happened.

Prepare a preview from selected missing candidates. Run a canary for up to five deliveries, wait for trusted ingestion receipts, review the result, and explicitly continue. GitHub’s redelivery acknowledgment alone is not completion. Calls are paced at one per second. Normal verification, deduplication, retention, retry, and destination flow settings govern ingestion and onward delivery.

Jobs expire 24 hours after creation, including approval waiting. A requested redelivery with no accepted receipt after five minutes stops the job. Canceled jobs stop new calls; an already in-flight request can finish. Provider calls can be repeated after a lost acknowledgment; the same GitHub delivery GUID and deduplication protect acceptance.

GitHub retains deliveries for three days and reuses the original GUID for redelivery. Repository webhooks are the first supported reconciliation provider. Read the GitHub delivery API, redelivery history limit, and GUID behavior. Verified against the official documentation on 30 September 2026.