Settings GitHub Runs Setup Prompt

GitHub runs setup prompt

Paste this into your coding agent (Claude Code, Codex, Copilot CLI…) from your repository’s folder. It checks the repository, asks before every change, and never sees your token or key. In Claude Code, once This laptop is set up, /ikanban-github-runs-setup does the same.

Help me set up my GitHub repository so iKanban sessions with "Runs on: GitHub" work for Claude, Copilot and Gemini. Run the checks yourself, ask me before pushing a branch, opening a pull request or opening a browser page, and never show a token or key.

Rules
- Secrets go in only through `gh secret set NAME -R <owner>/<repo>`, which asks me for the value without showing it. I paste it; you never see it.
- Repository settings and secrets need admin access to the repository.
- Go step by step. After each step, tell me what's ready and what I do next.

0. The basics (read-only)
   - `gh auth status` shows I'm signed in to github.com (if not, I run `gh auth login`).
   - `git remote get-url origin` gives `<owner>/<repo>`.
   - `gh repo view <owner>/<repo> --json viewerPermission -q .viewerPermission` says ADMIN. If not, I ask a repository admin.
   - List `.github/workflows` and `gh secret list -R <owner>/<repo>` (names only).

1. Claude
   - I install the Claude GitHub App on the repository: https://github.com/apps/claude → Install or Configure → this repository.
   - The token works from any machine, like a password, so I never paste it into this chat. I run `claude setup-token` (Claude Pro, Max, Team or Enterprise), copy the token, run `gh secret set CLAUDE_CODE_OAUTH_TOKEN -R <owner>/<repo>` and paste it.
   - Copy `.iKanban/github/claude.yml` to `.github/workflows/claude.yml`. If a `claude.yml` already exists, show me the difference and ask before replacing it: iKanban needs its steps that open the pull request and report the result.

2. Gemini
   - I create a key at https://aistudio.google.com/apikey, run `gh secret set GOOGLE_API_KEY -R <owner>/<repo>` and paste it.
   - I add credits in AI Studio → Billing (the free tier is 0 for the model the CLI uses).
   - Copy `.iKanban/github/gemini.yml` to `.github/workflows/gemini.yml` (Google's own workflow listens for @gemini-cli; iKanban writes @gemini).

3. Copilot
   - No file and no key. An organization owner opens the organization's Settings → Copilot → Cloud agent, sets the policy to Enabled, and includes this repository under Repository access.
   - I need a Copilot Business or Enterprise license from that organization.
   - Copilot runs this repository's hooks from .claude/settings.json and .github/hooks/*.json, and a hook that errors blocks it: its pull requests then change 0 files. Check that every script those hooks run is committed (git ls-files). A hook that calls a script outside the repository must skip when it's missing. Show me before changing hooks.
   - Copilot's pull requests open as drafts: mark one ready (gh pr ready <n>) before merging.
   - If the repository has a Claude review workflow (anthropics/claude-code-action), it fails on Copilot's PRs until it lists allowed_bots: "Copilot" and uses the job's GITHUB_TOKEN for bot PRs.

4. Merge the workflows to the default branch
   - Ask me first. Then create the branch `ikanban/github-runs`, commit the workflow files, push it, and open a pull request with `gh pr create --fill`. An admin merges it.

5. Prove it
   - In iKanban: composer → session settings → Runs on → GitHub, pick the agent, and send "reply with a one-line summary of this repository; don't change files". The session page shows the GitHub issue, then Done with the answer. Once per agent. For Copilot, also start one session that changes a file: its pull request must show at least 1 changed file.

If a run fails: Claude stopping within a second means the token is missing or expired (step 1); "GOOGLE_API_KEY isn't set" is step 2; "Google refused Gemini: credits used up or quota 0" means I add credits in Google AI Studio → Billing; "Copilot cloud agent isn't enabled" is step 3; nothing happening means the workflow isn't merged yet (step 4) or Actions are off.

Finish with one line per step: ready / needs action / couldn't check, and the fix.