@codacy/verity-cli 0.26.0-experimental.a2dc844 → 0.26.0-experimental.fb8a404

package/bin/verity.js

@@ -10474,10 +10474,9 @@ var SECURITY_PATTERNS = [
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
 var DEFAULT_SERVICE_URL = "https://yyfaqvcgslcrzvrbvqik.supabase.co/functions/v1".length > 0 ? "https://yyfaqvcgslcrzvrbvqik.supabase.co/functions/v1" : PROD_SERVICE_URL;
-var GITHUB_CLIENT_ID = "Ov23liBpj42KMTtUtN10";
+var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
-var GITHUB_OAUTH_SCOPES = "repo user:email";
 
 // src/lib/auth.ts
 async function resolveToken(flagToken) {
@@ -10761,7 +10760,7 @@ async function githubDeviceFlow() {
     const res = await fetch(GITHUB_DEVICE_CODE_URL, {
       method: "POST",
       headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
-      body: form({ client_id: GITHUB_CLIENT_ID, scope: GITHUB_OAUTH_SCOPES })
+      body: form({ client_id: GITHUB_CLIENT_ID })
     });
     if (!res.ok) {
       return { ok: false, error: `GitHub device-code request failed (HTTP ${res.status})` };
@@ -17081,7 +17080,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.26.0-experimental.a2dc844").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
+program.name("verity").description("CLI for Verity quality gate service").version("0.26.0-experimental.fb8a404").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
 registerAuthCommands(program);
 registerHooksCommands(program);
 registerIntentCommands(program);

package/data/skills/verity-setup/SKILL.md

@@ -346,13 +346,15 @@ verity auth verify
   verity auth register --project "PROJECT_NAME" --remote "GIT_REMOTE_URL"
   ```
 
-  Registration is **provider-gated** (GitHub today): the CLI runs a GitHub OAuth
+  Registration is **provider-gated** (GitHub today): the CLI runs a GitHub App
   **device flow** ("open https://github.com/login/device and enter code
   WXYZ-1234"), proving the user has **write access** to the repo before the
-  service issues a token.
+  service issues a token. The GitHub App requests only read-only permissions
+  (Metadata + Email addresses); the resulting token is used once server-side to
+  check repo access and is never persisted.
 
-When authenticated, `.verity/credentials` contains `token`, `service_url`, and
-`provider_token` — all subsequent `verity` upload commands work.
+When authenticated, `.verity/credentials` contains `token` and `service_url` —
+all subsequent `verity` upload commands work.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.26.0-experimental.a2dc844",
+  "version": "0.26.0-experimental.fb8a404",
   "description": "CLI for Verity quality gate service",
   "homepage": "https://verity.md",
   "repository": {