Credentials, Permissions & Infrastructure needing Owner approval
Nothing below has been created. Values must be entered by the owner directly (wrangler secret / Secrets Store / dashboard), never pasted into chat or committed.
| # | Item | Why | Needed for | Type |
|---|---|---|---|---|
| 1 | GitHub App registration (name, homepage https://devstack.bid, callback /api/auth/github-app/callback, webhook URL /api/webhooks/github) with permissions: Contents read, Metadata read, Pull requests read/write (PR comments), Commit statuses/Checks write; events: push, pull_request, installation, installation_repositories |
Per-repo least-privilege import of private repos, org picker, webhooks | M1 (import UX), M5 | Owner decision + GitHub org admin |
| 2 | GITHUB_APP_ID, GITHUB_APP_PRIVATE_KEY, GITHUB_WEBHOOK_SECRET, GITHUB_APP_CLIENT_ID/SECRET |
Sign installation tokens, verify webhooks | M1/M5 | Secrets Store |
| 3 | Cloudflare Queues binding BUILD_JOBS (+ DLQ) |
Build job dispatch/retry | M2 | Infra, Workers Paid |
| 4 | Cloudflare Containers builder image + Durable Object class | Isolated install/build | M2 | Infra + spend approval |
| 5 | R2 bucket devstack-build-artifacts (lifecycle: delete after N days) |
Build output + full logs | M2 | Infra |
| 6 | Test Cloudflare account + scoped API token (Workers Scripts: Edit, Account Settings: Read) for staging integration tests | Real provider tests, not mocks | M2–M3 | Credential (test only) |
| 7 | Test GitHub account/org with a public and a private sample repo | Import + webhook E2E | M1, M5 | Test fixture |
| 8 | Staging Worker (e.g. nvx-stack-builder-staging, separate D1 nvx-db-staging) |
Run E2E without touching production | M1+ | Infra |
| 9 | Remote D1 migrations 0013–0016 on production | Ship features | Release | GO — PUBLISH |
| 10 | Spend cap / quota numbers for builds per user per day | Cost control | M2 | Owner decision |
| 11 | Enable Worker preview URLs/versions for customer deployments (customer side, per token) | Preview URLs | M3 | Customer token scope note |
Not needed: DNS changes, production env var changes, Vercel credentials (provider stays a stub).
Source: docs/platform/CREDENTIALS-NEEDED.md · /docs/platform/credentials-needed.md