deploy

README.md

@@ -0,0 +1,36 @@
+# GitHub Repo Inspector
+
+Public A2A agent + packed React frontend for inspecting GitHub repositories with exact file-level citations.
+
+## Skills
+
+- `check_auth(github_token="")`: validates the supplied GitHub token or consumer secret without logging/returning it.
+- `list_repositories(github_token="", visibility="all", affiliation="owner,collaborator,organization_member", per_page=100, max_pages=10)`: lists accessible repositories with owner/name/default branch/private flag.
+- `inspect_repository(owner, repo, github_token="", ref="", include_hidden=true, max_files=750, max_bytes=4000000, max_file_bytes=250000)`: fetches a recursive tree, includes hidden files by default, classifies every tree entry, fetches supported text files within explicit limits, reports skipped binary/vendor/build/cache/limited files, analyzes line-level risks, and returns structured JSON plus markdown.
+- `create_issue(owner, repo, title, body, github_token="", labels=[])`: creates an issue for a confirmed recommendation/risk.
+
+## GitHub permissions
+
+Provide `github_token` in the UI/skill call or configure a consumer secret named `github_token` / `GITHUB_TOKEN`.
+
+Recommended scopes:
+
+- Public repos: `public_repo` or fine-grained read-only Contents metadata/content access.
+- Private repos: `repo` or fine-grained repository Contents read + Metadata read.
+- Issue creation: `repo` or fine-grained Issues read/write.
+
+Tokens are never stored, logged, or returned. Snippets redact likely secrets.
+
+## Limits and safety
+
+The scanner inspects all fetched tree metadata. It fetches supported text blobs until `max_files`, `max_bytes`, or `max_file_bytes` limits are reached. Skipped files include an explicit reason such as binary extension, vendor/build/cache folder, too-large file, or aggregate byte limit.
+
+Findings use conservative deterministic heuristics and should be treated as review prompts unless the cited evidence clearly proves the issue.
+
+## Local checks
+
+```bash
+pytest tests
+```
+
+Packed frontend is served at `/app` after deployment.