Secure and verify the Rock Music GitHub App

[SayanthRock]

Goal

Make the account-level Rock Music Sayanth GitHub App secure and genuinely operational for Sayanthrock-Developer/Rock-music.

Verified

• GitHub App created under Sayanthrock-Developer
• App ID and Client ID issued
• Repository-side least-privilege manifest and setup documentation merged
• Initial repository permissions documented as read-only
• Repository template changed to fail closed while placeholder endpoints remain
• CI validation added to reject active placeholder webhooks, unapproved permissions/events, and obvious embedded credentials

Required before completion

• Revoke the private key that was uploaded outside the backend secret manager
• Generate a replacement private key and store it only in an encrypted backend secret manager
• Revoke any client secret that was exposed in a screenshot or message
• Generate a new client secret only if the trusted backend actually needs user OAuth
• Deploy real HTTPS callback, setup, and webhook endpoints
• Replace every placeholder URL in the live GitHub App settings
• Generate and store a strong webhook secret only on the backend
• Verify X-Hub-Signature-256 using HMAC-SHA256 and constant-time comparison
• Reject duplicate webhook deliveries using X-GitHub-Delivery
• Install the app only on Sayanthrock-Developer/Rock-music
• Confirm the installation ID and selected-repository restriction
• Verify backend JWT creation and installation-token exchange
• Confirm installation tokens never reach the Android APK, repository, logs, screenshots, or client responses
• Test unavailable, not-installed, permission-missing, offline, rate-limit, and service-error states in Android
• Review GitHub App audit logs and final permissions

Repository assets

• .github/github-app-manifest.json
• .github/scripts/validate-github-app-manifest.py
• docs/GITHUB_APP_SETUP.md
• docs/github-app.env.example

Security boundary

The GitHub App private key, webhook secret, client secret, installation tokens, user tokens, and JWTs must never be committed or embedded in the Android APK. The Android application communicates only with a trusted backend that returns normalized, minimum-required data.

Definition of done

Close this issue only after the replacement credentials are stored securely, real HTTPS endpoints are configured, webhook verification passes, duplicate delivery handling is tested, the app is installed only on the selected repository, installation-token exchange succeeds server-side, and no secret is present in source, APKs, logs, screenshots, issues, pull requests, or client responses.