github

Starts the GitHub App install flow — mints a signed state token binding this install to org.org_id (see app_auth.verify_install_state for why the callback trusts this instead of whatever org happens to be active in the browser that completes it) and points at the App's own install URL, fetched live rather than a hardcoded slug.

Called server-to-server by apps/web's /api/github/callback route (the URL actually registered in the App's settings — GitHub redirects the browser there, not here) once GitHub redirects back with a real installation_id. Every genuine install this app itself started carries state (see install-url above) — that signature IS the auth for this endpoint, there's no session/API-key check here at all, same trust model as gnt/slack/oauth.py's own oauth_callback. setup_action values other than "install" (a pending "request" awaiting an org owner's approval, or a repo-selection "update" from GitHub's own installation settings page, which doesn't carry state at all) aren't handled here — out of scope for this connect flow; re-running gnt connect github covers the update case in practice.