.env.example

# Copy to .env and fill in. .env is gitignored.

# Org to monitor.
GITHUB_ORG=GTNewHorizons

# --- GitHub App -------------------------------------------------------------
#
# The App is what sees private repos, and what delivers webhooks later. Only the
# private key is secret: the App ID is public (it appears in the App's own URL)
# and the installation ID is derived at runtime rather than stored, because
# reinstalling the App mints a new one.
#
# GitHub issues the key as PKCS#1. Convert it once — Cloudflare Workers'
# WebCrypto will only import PKCS#8, and Node accepts either:
#
#   openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt \
#     -in <downloaded>.pem -out nh-dashbot-pk8.pem
#
# Check the whole chain with: npm run verify:app
GH_APP_ID=
GH_APP_KEY_PATH=nh-dashbot-pk8.pem

# In CI, pass the key contents directly instead of a path.
# GH_APP_PRIVATE_KEY=

# --- Legacy token -----------------------------------------------------------
#
# Pre-App auth, still used by the ingest and build until those move over.
# Classic token with "public_repo" scope. Cannot see private repos — that's
# what the App is for.
GITHUB_TOKEN=

# --- Exclusions -------------------------------------------------------------
#
# Comma-separated repo names that never enter the store: not fetched, not
# built, not deployed. Wildcards (* ?) work, and a leading ! re-includes
# something an earlier pattern caught.
#
# Kept out of committed config on purpose. For most repos the name is harmless,
# but where a private repo's existence is itself the sensitive part, writing it
# into source would publish the very fact the exclusion is there to hide.
NH_INGEST_EXCLUDE=

# Adds to the "needs release" panel's exclusions without a commit.
# NH_RELEASE_EXCLUDE=