GitHub integration

Connecting a project to its GitHub repository lets Quiet Guard follow the work that ships your app and correlate production errors back to the commit that introduced them.

On the paid plans. The GitHub integration is part of Indie and Studio. On Free the project's Settings page shows what the integration does instead of the repository fields. Everything already synchronised stays visible on the project's GitHub tab; nothing new is fetched while the plan does not include it.

Connect a repository

On the project's Settings page, section GitHub integration, fill in:

• Repository: the repository in owner/name form (e.g. acme/store), exactly as it reads in the GitHub URL.
• Access token: a GitHub personal access token that can read that repository. Quiet Guard only ever reads three things: the repository's metadata, its commits and branches, and its pull requests. It never writes.

Create the token on GitHub

1. Signed in to GitHub with an account that can see the repository, open Settings > Developer settings > Personal access tokens > Fine-grained tokens, then Generate new token. Direct address: https://github.com/settings/personal-access-tokens/new.
2. Resource owner: the user or organisation that owns the repository. For an organisation's repository, choose the organisation, not your own account; some organisations require an administrator to approve the token before it works.
3. Repository access: Only select repositories, then the one repository.
4. Repository permissions: Contents in Read-only (commits and branches) and Pull requests in Read-only. GitHub adds Metadata in Read-only by itself. Nothing else.
5. Expiration: whatever your policy allows. When the token expires, synchronisation stops and nothing new appears in the GitHub tab until you paste a new one.
6. Generate the token and copy it (it starts with github_pat_): GitHub shows it once.

Paste it in the Access token field and save. The field never shows the stored token again: leave it blank on later saves to keep the current one, type a new one to replace it.

A classic personal access token works too, with the repo scope for a private repository or public_repo for a public one. The fine-grained kind is preferred: it can be limited to one repository and to read-only permissions, which is all this integration uses.

The token is encrypted at rest. The github_token column is stored using Laravel's encrypted cast, so the token is never persisted in clear in the database.

A project is considered GitHub-connected once both a repository and a token are present. Run Sync GitHub once right after saving: it is the quickest way to find out a token does not open the repository.

What gets synced

Syncing fetches and stores three kinds of repository activity:

• Commits: recent commits, with SHA, message, author and timestamp.
• Pull requests: open and recent PRs.
• Branches: the repository's branches, reconciled on each sync (branches that disappeared upstream are removed locally).

Syncing follows a fetch-all-then-write-in-a-transaction approach: data is pulled from the GitHub REST API first and written in one transaction, so a partial network failure never leaves the project with a half-updated picture.

Run a sync

Use the Sync GitHub action on the project to pull the latest activity on demand. The synced commits, PRs and branches are shown in the project's GitHub tab.

On the plans that carry the integration, a connected project is also synced on its own, a few times a day, so the picture stays current between two deploys without anyone clicking.

Release → commit correlation

This is where the GitHub data pays off. When an exception occurrence carries a release value that is a commit SHA, Quiet Guard resolves it to the matching synced commit. From the issue you can open the exact commit that was deployed when the error happened.

For this to resolve, two things must line up:

1. Your app sends the deployed commit SHA as context.release in the exception payload.
2. That commit has been synced from GitHub.

Tip: wire your deploy pipeline to set the release to the deployed Git SHA, and run a GitHub sync after each deploy, so the error → commit link is always available.