---
name: tidbcloud-github-access
description: Authenticate to GitHub and work with repositories under github.com/tidbcloud using the approved GitHub App `data-service-code-assistant`. Use when cloning, fetching, checking out, or otherwise accessing any `tidbcloud/*` repository, or when a task needs org-approved GitHub authentication instead of personal auth.
---

# TiDB Cloud GitHub Access

Use this skill for any `github.com/tidbcloud/*` repository access.

## Core rule

For `tidbcloud/*` repositories, always authenticate using GitHub App `data-service-code-assistant` via the bundled script:

- `scripts/get-gh-token.sh`

Do not rely on personal GitHub auth for repo access if the task touches `tidbcloud/*`.

## Practical usage

The script **automatically discovers** the installation ID from the target repo — just pass `owner/repo` as argument.

```bash
# Set APP_ID via env or .env file
export TIDBCLOUD_GH_APP_ID=3002333

# Get token (repo is required)
export GH_TOKEN="$(scripts/get-gh-token.sh tidbcloud/dataflow-service)"
```

After getting the token, you can use it for `gh`, `git fetch`, or workflow-dispatch.

The generated installation access token explicitly requests `actions:write` (plus `contents:write`, `issues:write`, `pull_requests:write`) so `gh workflow run` can dispatch workflows reliably.

## Guardrails

- Do not switch to personal GitHub auth for `tidbcloud/*` repo access.
- Do not hardcode temporary tokens into files.