GitHub integration

Git repositories are the centerpiece of the vast majority of software projects out there. We integrate with GitHub to provide Tuist insights right in your pull requests and to save you some configuration such as syncing your default branch.

Setup#

You will need to install the Tuist GitHub app in the Integrations tab of your organization:

You can also install the app directly from GitHub. Log in to Tuist if needed, authorize the GitHub App so Tuist can verify your access to the installation, and choose the Tuist organization to connect. You must own the GitHub organization (or the personal GitHub account) where the app is installed. Only Tuist organizations you administer and your personal Tuist account are available. If only one account is available, Tuist connects it automatically without showing the chooser. When you start from Tuist, the organization is already selected and this step is skipped.

After that, you can add a project connection between your GitHub repository and your Tuist project:

Once the app is installed, you can also link a project without the dashboard:

• CLI:tuist project repository connect owner/name, and tuist project repository disconnect to remove the link.
• REST API:PUT and DELETE on /api/projects/{account_handle}/{project_handle}/vcs-connection.
• Model Context Protocol: the connect_project_repository and disconnect_project_repository tools.

The repository must be one the GitHub App installation can access, and the project adopts the repository's default branch. Account tokens need the project:admin:write scope.

GitHub Enterprise Server#

Tuist also integrates with self-hosted GitHub Enterprise Server (GHES) instances. In the GitHub integration card, switch to the Enterprise server tab, enter your GHES base URL (for example https://github.example.com), and click install.

Because GitHub Apps are scoped to a single GitHub instance, Tuist cannot reuse its github.com App on your GHES — instead, the install button takes you through GitHub's App manifest flow: GHES walks your administrator through registering a fresh Tuist App on the instance, then hands the new App's credentials back to Tuist. Tuist stores those credentials encrypted per-installation and uses them for every API call, webhook signature, and link to your repositories from then on.

No additional Tuist server configuration is needed; the manifest flow generates and provisions everything automatically.

App permissions and webhook events#

Tuist requires the following repository permissions for PR comments and bundle-size checks:

Tuist uses the check_run webhook event to handle bundle-size check actions. The manifest flow configures this subscription automatically.

For manual App setup on github.com with a self-hosted Tuist server, see the self-hosting guide.

Separate browser and API URLs#

If engineers access GitHub Enterprise through an internal hostname while third-party services use an external proxy, configure both addresses before clicking install:

The API URL is the full REST API base URL, including /api/v3 or the equivalent path exposed by your proxy. Tuist does not append /api/v3 to an explicit API URL. Leave it empty if one hostname works for both your browser and Tuist; existing connections keep using <Server URL>/api/v3.

Both addresses must route to the same GitHub Enterprise instance. Your browser only needs to reach the Server URL, not the API proxy. Tuist's servers only need to reach the API URL, not the internal browser hostname.

For the external proxy:

• Use HTTPS with a certificate trusted by Tuist's servers and public DNS resolving to public IP addresses. API URL overrides do not bypass Tuist's private-IP/SSRF protections. The override must target your Enterprise instance, not github.com or a *.github.com endpoint.
• Allowlist every Tuist outbound IP address.
• Forward the REST API endpoints Tuist uses, including POST /api/v3/app-manifests/{code}/conversions, POST /api/v3/app/installations/{installation_id}/access_tokens, and repository API endpoints for comments and checks. These are GitHub's upstream paths; translate them if your proxy exposes a different prefix.
• Forward requests to GitHub without HTTP redirects or an interactive sign-in page. Tuist does not automatically follow Enterprise API redirects, so they cannot bypass public-IP checks. The manifest conversion endpoint must be reachable during setup, before Tuist has the App's credentials. GitHub Actions log downloads are an exception: Tuist follows signed archive redirects only over HTTPS, checks and pins every destination to a public IP, and does not forward the installation token.

GitHub may return pagination links using its internal hostname. Tuist rebases links from the configured GitHub instance onto the API URL, preserving your proxy's path prefix; links to unrelated origins are rejected.

Separately, GitHub must be able to deliver webhooks to https://tuist.dev/webhooks/github (or /webhooks/github on your self-hosted Tuist server). Engineers must be able to return to Tuist to complete the browser callbacks. The API URL does not change either destination.

Organization administrators can also change or clear the API URL on an existing Enterprise integration using Save API URL in the integration card. No App reinstallation or project reconnection is needed. Clearing it restores <Server URL>/api/v3. Saving validates the URL format, not proxy connectivity. Webhook processing may take up to one minute to use a changed address because installation lookups are cached; requests already in flight may still use the previous address.

Pull/merge request comments#

The GitHub app posts a Tuist run report, which includes a summary of the PR, including links to the latest previews or tests:

Tuist updates one comment as results arrive. Gradle builds appear separately for each root project and set of requested tasks; rerunning the same tasks replaces that invocation's previous result. The full build history remains available on Tuist.

Comments are enabled by default, preserving reporting for existing integrations. To turn them off or back on for a project, open Project Settings → Integrations and toggle GitHub → Run report comments. Each project has its own setting; repository connections remain managed in organization settings.

Disabling comments does not disable build or test uploads, GitHub Actions job summaries, repository connections, or other GitHub integration features. Existing comments are not deleted.

GitHub Actions job summary#

The Tuist CLI and Gradle plugin write test and build results to the job summary in GitHub Actions. The summary links to the full report on Tuist, where richer insights such as flaky tests and bundle-size deltas are available.

For Gradle, each successfully uploaded build or test report appends its own summary, preserving other content written by tools such as gradle/actions/setup-gradle. This requires a plugin version that includes job summary support; older Gradle plugin versions only report through the GitHub App's PR comment. The GitHub App does not need to be connected for job summaries, and disabling Run report comments does not affect them.

When a GitHub Actions summary destination is available, Gradle waits for uploads and summaries before exiting, even if uploadInBackground is enabled. GitHub captures the summary when the workflow step finishes.

This is particularly useful with merge queues. A merge queue run is not attached to a pull request, so no comment is posted, but the job summary still surfaces the results.