GitHub
Limn reads and writes GitHub through your own gh sign-in. What it reads, what it writes and when.
On this page
GitHub is Limn’s main source of data. Limn reads your repositories’ pull requests, reviews, comments, commits and checks, and keeps a copy on your computer. It does this through the GitHub CLI, gh, that you are already signed in to. Limn has no GitHub app, no sign-in of its own and no server in between, and it does not store your GitHub token.
#What you need
- The GitHub CLI, from cli.github.com.
- A signed-in session: run
gh auth loginonce in a terminal and follow the prompts. - Read access to the repositories you add. To merge, approve, push or post, you need write access.
- Limn works with github.com.
- Run
gh auth loginand choose GitHub.com. - Start Limn with
npx limn-review. It asksghfor your token each time it needs one. - Add repositories (see Add repositories).
Organisations with single sign-on
If your organisation uses SAML single sign-on, your gh session must be authorised for it. Until it is, a banner says “Your GitHub login is not authorized for” the organisation, and its pull requests, checks and comments cannot be synced. Run gh auth refresh in a terminal and authorise the organisation. If that is not enough, run gh auth refresh -h github.com -s read:org.
#What Limn reads
- Pull requests, their reviews, review threads, comments and reactions.
- Commits and the files they changed, and check and status results.
- The default branch’s latest commits and checks, for the trunk strip.
- Merge state, merge queue membership and who may merge.
- CI job logs, read when you open them and never stored.
- With GitHub Issues as your tracker, the linked issues.
The first sync of a repository reads about the last 14 days quickly, then fills in the last 90 days in the background. After that, Limn checks each repository as often as its activity calls for, and a pull request you have open every few seconds. Large text, such as pull request descriptions and diff hunks, is fetched when you open the pull request.
#Rate limits are handled for you
GitHub gives each account an hourly allowance of requests. Limn plans its work around that allowance and slows down before it runs out, rather than failing. When a repository has to wait, the sync panel says Paused — GitHub rate limit and when it will resume. Nothing is lost; the sync carries on from where it stopped.
#What Limn writes, and when
Limn writes to GitHub only when you press a button, or when you have switched on an automatic action. Every write goes out under your own GitHub account.
| Write | When |
|---|---|
| Comments, replies, resolving threads, reactions | When you press the button |
| Approve, request changes, withdraw approval | When you press, or by a dependency rule you switched on |
| AI review findings, as one GitHub review | When you press, or by auto-posting (on by default) |
| Merge, add to or remove from a merge queue, update branch | When you press, or for a pull request you armed |
| Pushes from AI Fix, Implement story and the conflict resolver | When you press Push, or if you switched on automatic pushing |
| Open a pull request | When you press, from Implement story or the conflict resolver |
| Re-run CI jobs, request reviewers, close or reopen | When you press the button |
| limn/ commit statuses | On each auto review and dependency action, to tell teammates’ Limn the work is under way |
#How Limn’s own actions are shown
On GitHub, Limn’s posts appear under your name, with a hidden marker so every copy of Limn can recognise them. Inside Limn they are shown as a bot that acts for you, “Limn · your login”, so they are never mistaken for your own words. A teammate’s Limn is named too, for example “Robin’s Limn: addressed”.
refunds/policy.py:41Because of this, Limn’s actions never count as yours anywhere in Limn. They do not take your turn on Pending, they are not your replies in thread states, and they are counted under Limn in Reports.
#Remove access
To stop Limn reading GitHub, stop Limn, or sign gh out with gh auth logout. To remove a repository, remove it in Limn; its stored data is deleted. For how Limn stores and protects what it reads, see GitHub access.
Major: RefundPolicy.allows() never reads paid_at, so refunds after 30 days still go through.