DashboardSecurity
Trust, scopes, and what OpenKeep touches
Trust is the product. OpenKeep is a GitHub App that finds OpenAI usage and opens draft migration PRs humans merge. We measure merge rate, not vanity installs. There is no automerge path.
Mandates
Draft PRs only
Every migration PR is opened as a draft. Humans merge. If GitHub returns a non-draft PR, OpenKeep errors instead of continuing.
Never automerge
There is no automerge flag, no merge queue hook, and no bot merge. A merged row in the dashboard is a human (or GitHub UI) merge of our draft.
OpenAI-migration-only
The wedge is Assistants → Responses and pinned OpenAI model sunsets (Aug 26 / Oct 23). OpenKeep does not review general PRs, other model vendors, or Marketplace listings.
Minimal GitHub scopes
Contents, Pull requests, and Metadata only. We will not ask for Actions, Administration, Checks, or anything else for this wedge.
Minimal GitHub scopes
Intended permissions for the OpenKeep GitHub App. We will not expand this set for the OpenAI migration wedge.
| Permission | Access | Why |
|---|---|---|
| Contents | Read & write | Read source to scan for Assistants and pinned model IDs. Write only draft branches (openkeep/scan-*) and OPENKEEP_MIGRATION.md on those branches. |
| Pull requests | Read & write | Open and update draft migration PRs, plus summary and inline comments on those drafts. Never approve, never request-changes as a merge gate, never merge. |
| Metadata | Read | See which repos the App is installed on. Required by GitHub for every App. |
What OpenKeep reads
- Installed repositories (names, default branch, git tree) so we can scan for OpenAI call-sites.
- File contents that look like source (TypeScript, Python, JSON, YAML, …) — not your secrets store, not unrelated vendors.
- The OpenKeep draft PR and its comments, so /openkeep rescan|explain|ignore and push re-scans stay on the same draft.
What OpenKeep writes
- A draft branch named openkeep/scan-* and a draft pull request. draft: true is an invariant — OpenKeep refuses a non-draft GitHub response.
- OPENKEEP_MIGRATION.md plus in-place model ID remaps and Assistants sketches under openkeep-drafts/.
- A summary issue comment and inline review comments on finding lines (COMMENT reviews only).
- Nothing on merge. OpenKeep never calls GitHub merge APIs and never marks a PR ready for review.
Notifications
When a draft migration PR is opened or updated, OpenKeep writes an in-app notification on the dashboard. Email is sent only when RESEND_API_KEY is set — we do not fake outbound mail. Slack and Marketplace are out of scope.