GitHub integration

Git repositories are the centerpiece of the vast majority of software projects out there. We integrate with GitHub to provide Tuist insights right in your pull requests and to save you some configuration such as syncing your default branch.

Setup#

You will need to install the Tuist GitHub app in the Integrations tab of your organization:

After that, you can add a project connection between your GitHub repository and your Tuist project:

GitHub Enterprise Server#

Tuist also integrates with self-hosted GitHub Enterprise Server (GHES) instances. In the GitHub integration card, switch to the Enterprise server tab, enter your GHES base URL (for example https://github.example.com), and click install.

Because GitHub Apps are scoped to a single GitHub instance, Tuist cannot reuse its github.com App on your GHES — instead, the install button takes you through GitHub's App manifest flow: GHES walks your administrator through registering a fresh Tuist App on the instance, then hands the new App's credentials back to Tuist. Tuist stores those credentials encrypted per-installation and uses them for every API call, webhook signature, and link to your repositories from then on.

No additional Tuist server configuration is needed; the manifest flow generates and provisions everything automatically.

App permissions and webhook events#

Tuist requires the following repository permissions for PR comments and bundle-size checks:

Tuist uses the check_run webhook event to handle bundle-size check actions. The manifest flow configures this subscription automatically.

For manual App setup on github.com with a self-hosted Tuist server, see the self-hosting guide.

Separate browser and API URLs#

If engineers access GitHub Enterprise through an internal hostname while third-party services use an external proxy, configure both addresses before clicking install:

The API URL is the full REST API base URL, including /api/v3 or the equivalent path exposed by your proxy. Tuist does not append /api/v3 to an explicit API URL. Leave it empty if one hostname works for both your browser and Tuist; existing connections keep using <Server URL>/api/v3.

Both addresses must route to the same GitHub Enterprise instance. Your browser only needs to reach the Server URL, not the API proxy. Tuist's servers only need to reach the API URL, not the internal browser hostname.

For the external proxy:

• Use HTTPS with a certificate trusted by Tuist's servers and public DNS resolving to public IP addresses. API URL overrides do not bypass Tuist's private-IP/SSRF protections. The override must target your Enterprise instance, not github.com or a *.github.com endpoint.
• Allowlist every Tuist outbound IP address.
• Forward the REST API endpoints Tuist uses, including POST /api/v3/app-manifests/{code}/conversions, POST /api/v3/app/installations/{installation_id}/access_tokens, and repository API endpoints for comments and checks. These are GitHub's upstream paths; translate them if your proxy exposes a different prefix.
• Forward requests to GitHub without HTTP redirects or an interactive sign-in page. Tuist does not automatically follow Enterprise API redirects, so they cannot bypass public-IP checks. The manifest conversion endpoint must be reachable during setup, before Tuist has the App's credentials. GitHub Actions log downloads are an exception: Tuist follows signed archive redirects only over HTTPS, checks and pins every destination to a public IP, and does not forward the installation token.

GitHub may return pagination links using its internal hostname. Tuist rebases links from the configured GitHub instance onto the API URL, preserving your proxy's path prefix; links to unrelated origins are rejected.

Separately, GitHub must be able to deliver webhooks to https://tuist.dev/webhooks/github (or /webhooks/github on your self-hosted Tuist server). Engineers must be able to return to Tuist to complete the browser callbacks. The API URL does not change either destination.

Organization administrators can also change or clear the API URL on an existing Enterprise integration using Save API URL in the integration card. No App reinstallation or project reconnection is needed. Clearing it restores <Server URL>/api/v3. Saving validates the URL format, not proxy connectivity. Webhook processing may take up to one minute to use a changed address because installation lookups are cached; requests already in flight may still use the previous address.

Pull/merge request comments#

The GitHub app posts a Tuist run report, which includes a summary of the PR, including links to the latest previews or tests:

GitHub Actions job summary#

When you run Tuist in GitHub Actions, it writes a run report to the job summary of the workflow run, so you see your test and build results on the run's summary page with nothing extra to set up. The summary links to the full report on Tuist, where richer insights such as flaky tests and bundle-size deltas are available.

This is particularly useful with merge queues. A merge queue run is not attached to a pull request, so no comment is posted, but the job summary still surfaces the results.