OPERATE YOUR OWN REVIEWER

Install the App.
Keep the keys.

The Cururu GitHub App runs on your infrastructure. GitHub delivers signed webhooks; Cururu verifies, queues and processes them without a hosted Cururu service.

01 / GITHUB APP SETUP

Create the installation.

Each operator creates their own GitHub App for their own Cururu deployment; there is no shared central App. Configure its webhook URL as https://your-hostname/v1/webhooks/github and set a unique webhook secret.

ContentsRead repository config, context and diffs.

ChecksRead Check Run annotations when analyzer evidence is enabled.

Pull requestsRead PRs; write formal reviews and inline comments.

IssuesWrite summary comments and mention replies.

EventsPull request, issue comment and pull request review comment.

Metadata read is granted automatically. Add only the repositories where Cururu should operate.

02 / PRIVATE BASE CONFIG

Access follows your installation.

Install your App on both consumer and shared-config repositories. An all-repositories installation can read new bases in that organization without per-repository changes. Selective installations require an admin to add each repository. For a base in another organization, install your App there too; Cururu uses that installation's read token for the pinned config fetch.

Pin the base to a full commit SHA in the trusted consumer `.cururu.toml`.

[config]
base = 'acme/engineering-standards'
base_ref = '0123456789abcdef0123456789abcdef01234567'
base_path = 'configs/cururu/base.toml'

03 / DEPLOY

Choose the storage you already trust.

Copy the environment template, place the GitHub App PEM key in the ignored `secrets/` directory, set the LLM and webhook secrets, then select a Compose file.

cp .env.example .env
# edit .env and place the private key at the configured file path
docker compose up -d --build

# or use SQLite with a persistent volume
docker compose --env-file .env -f compose.sqlite.yaml up -d --build

PostgreSQLDurable queue for deployments that already run Postgres or need database separation.

SQLiteSingle-instance setup with WAL mode and an online backup command.

SQLite online backup: cururu backup-sqlite /data/cururu-backup.db. Litestream can replicate the mounted database file when configured as a sidecar.

04 / INTERACTIONS

Reviews and replies.

Cururu submits a formal advisory review and attempts to request its bot identity as a reviewer. GitHub may reject bot reviewer requests; the formal review still identifies Cururu. Write-authorized collaborators can run `/cururu review`, mention `@cururu`, or reply directly to a Cururu suggestion.

/cururu review
/cururu review --full

@cururu Why is this change needed?

SECURITY BOUNDARY

Webhook text is still untrusted.

Cururu verifies HMAC signatures before parsing or queueing, uses short-lived installation tokens, never checks out PR-head code, and treats diffs and comments as data. Put secrets in the deployment's secret manager, not `.cururu.toml`.

Full deployment and operations guide →