littlebird/github-app-bot-identity-for-littlebird

All proposals

Proposal: a dedicated GitHub App identity for Littlebird’s GitHub integration

For: littlebird.ai product/engineering team From: Christopher Wilson, Founding Brand Ambassador Date: September 9, 2026 Status: Draft — for Christopher to review before sending

Summary

Littlebird’s current GitHub integration writes commits under my own GitHub account credentials (personal OAuth grant or token), rather than under a distinct identity of her own. I’d like to propose switching that integration to a GitHub App installation with its own bot identity — the same pattern GitHub Copilot, Dependabot, and most serious GitHub-integrated tools use. This would improve the integration for every user who connects GitHub, not just me.

The problem, concretely

Over the past week I gave Littlebird write access to 14 of my repositories. She made 37 real, useful commits establishing cross-agent coordination notes across my project fleet. Every single one of those commits is authored as me — my name, my email, my GitHub identity — with only a Co-Authored-By: trailer distinguishing her contribution from something I typed myself.

Two consequences fall out of that:

  1. Scope. A personal OAuth grant or token gives Littlebird the same permissions I have across every repo it’s authorized against — full read/write, no per-repo or per-action boundary. There’s no way to scope her to “can create files under AGENT-SYNC/” or “can’t force-push” — it’s an all-or-nothing grant tied to my own account.
  2. Attribution. Because there’s no distinct account behind the commits, Littlebird can never show up as a linked contributor in a repo’s Insights → Contributors graph, or get a clickable avatar on her own commits — GitHub only renders that for a trailer email verified on a real account. Her actual contribution is invisible to GitHub’s own tooling, even though it’s real, substantial work.

The ask

Support connecting GitHub via a GitHub App installation (with a bot identity like littlebird-ai[bot]) as an alternative to the current personal-token flow. A GitHub App gets:

  • Its own identity — commits and PRs are authored as the App, not as the connecting user, so they show up correctly in Insights and are visually distinguishable in history at a glance.
  • Fine-grained, repository-scoped permissions — an installation can be limited to specific repos and specific permission types (contents: write, but not admin; no access to Actions secrets; etc.), instead of inheriting the full scope of a personal account.
  • Independent revocation — I could revoke Littlebird’s GitHub access from the App’s installation settings without touching my own account’s tokens, and vice versa.

Why this helps littlebird.ai too

This isn’t just a me-specific request — anyone who connects Littlebird to GitHub today is granting the same broad, unscoped access under their own identity. A GitHub App default would be a safer out-of-the-box posture for the product generally, and “Littlebird shows up as a real contributor on your repos” is a genuinely good, demonstrable feature to point ambassador content at.

What I’m not asking for

Not asking for this to block anything already working — the personal-token flow functions, and I’m not proposing turning it off. This is a forward-looking feature request, not an urgent fix.

Read more, or follow along: drasticstatic.github.io/littlebird-ambassador-public-preview

Littlebird Ambassador