GATE Watcher — GitHub

Self-hosted daemon that monitors your GitHub notifications and repository events, pushing them to GATE cloud for security processing. Your GitHub token never leaves your machine.

How it works

Your Machine (Watcher)              GATE Cloud
┌─────────────────────┐        ┌──────────────────┐
│ GitHub API polling   │───────>│ Security pipeline │
│ (token stays HERE)   │<───────│ (redact, policy,  │
│                      │ poll   │  audit, forward)  │
└─────────────────────┘        └──────────────────┘

Quick Start (CLI)

cd gate-watcher-github
npm install

# Create .env (or pass env vars directly)
cp .env.example .env
# Fill in GATE_KEY, GATE_INTEGRATION_ID, GITHUB_TOKEN

npm start

Embed in Your App (SDK)

npm install @anura-gate/watcher-github

const { GateGitHubWatcher } = require("@anura-gate/watcher-github");

const watcher = new GateGitHubWatcher({
  gateKey: "gk-xxx",
  integrationId: "int_xxx",
  githubToken: "ghp_xxx",
  repos: ["owner/repo1", "owner/repo2"], // optional — omit to watch all notifications
});

watcher.on("ready", (username) => {
  console.log(`GitHub connected: ${username}`);
});

// Every GitHub event after GATE security processing
watcher.on("event", (event, result) => {
  console.log(`Event: ${event.eventType}, Repo: ${event.repo}`);
  console.log(`Security actions: ${result.securityActions}`);
});

watcher.on("action_result", ({ action, success, error }) => {
  console.log(`${action}: ${success ? "done" : error}`);
});

await watcher.start();

// Later...
await watcher.stop();

SDK Events

| Event | Args | Description | |---|---|---| | ready | (username) | Connected to GitHub | | event | (event, result) | GitHub event processed by GATE | | action | (action) | Outbound action received from GATE queue | | action_result | ({ actionId, action, success, result, error }) | Outbound action completed | | gate_error | ({ path, status, error }) | GATE API call failed | | github_error | ({ path, error }) | GitHub API call failed | | limit_reached | (type) | Plan limit hit | | stopped | — | Watcher fully shut down |

SDK Options

| Option | Required | Default | Description | |---|---|---|---| | gateKey | Yes | — | Virtual key (gk-xxx) | | integrationId | Yes | — | Integration ID (int_xxx) | | githubToken | Yes | — | GitHub Personal Access Token (ghp_...) | | gateUrl | No | "https://anuragate.com" | GATE cloud URL | | repos | No | [] | Array of "owner/repo" to watch. Empty = all notifications | | pollInterval | No | 60000 | ms between GitHub API polls | | heartbeatInterval | No | 30000 | ms between heartbeats | | sessionId | No | — | Session ID for multi-tenant use | | sessionLabel | No | — | Human-readable session label | | sessionMetadata | No | {} | Arbitrary metadata for the session |

Setup

1. Go to github.com/settings/tokens and create a Personal Access Token
2. Required scopes: repo, notifications
3. Go to GATE Dashboard → Integrations → Add Integration
4. Select GitHub, copy the Integration ID
5. Copy your Virtual Key from the Keys page
6. Set the env vars and run

Environment Variables

| Variable | Required | Description | |---|---|---| | GATE_KEY | Yes | Your GATE virtual key | | GATE_INTEGRATION_ID | Yes | Integration ID from the dashboard | | GITHUB_TOKEN | Yes | Personal Access Token (ghp_...) | | GITHUB_REPOS | No | Comma-separated repos to watch: owner/repo1,owner/repo2 | | GATE_URL | No | Custom GATE cloud URL | | WEB_PORT | No | Port for the dev dashboard (CLI only) |

Security model

• GitHub token stored in .env on YOUR machine
• GATE cloud never sees or stores your credentials
• All event content passes through GATE's security pipeline
• Billing, limits, and security enforced server-side