From a69339804c8a2b3598f50cefcf6e4ab0565e18e1 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sat, 25 Oct 2025 10:50:50 +0200
Subject: [PATCH] feat: add warnings for system-wide GitHub Apps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added warning callouts to inform users that system-wide GitHub Apps are not recommended for security reasons.

Changes:
- Added warning callout in Create view when system-wide checkbox is enabled
- Added warning callout in Change view when GitHub App is system-wide
- Warning explains that system-wide apps are shared across all teams and can access repositories from any team
- Recommends creating team-specific GitHub Apps for better security and isolation

The warnings only appear on self-hosted instances where system-wide option is available (not on cloud).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 resources/views/livewire/source/github/change.blade.php | 5 +++++
 resources/views/livewire/source/github/create.blade.php | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/resources/views/livewire/source/github/change.blade.php b/resources/views/livewire/source/github/change.blade.php
index 6e1da2a02..4f660bc94 100644
--- a/resources/views/livewire/source/github/change.blade.php
+++ b/resources/views/livewire/source/github/change.blade.php
@@ -72,6 +72,11 @@ class="bg-transparent border-transparent hover:bg-transparent hover:border-trans
                                 helper="If checked, this GitHub App will be available for everyone in this Coolify instance."
                                 instantSave id="isSystemWide" />
                         </div>
+                        @if ($isSystemWide)
+                            <x-callout type="warning" title="Not Recommended">
+                                System-wide GitHub Apps are shared across all teams on this Coolify instance. This means any team can use this GitHub App to deploy applications from your repositories. For better security and isolation, it's recommended to create team-specific GitHub Apps instead.
+                            </x-callout>
+                        @endif
                     @endif
                     <div class="flex flex-col sm:flex-row gap-2">
                         <x-forms.input canGate="update" :canResource="$github_app" id="htmlUrl" label="HTML Url" />
diff --git a/resources/views/livewire/source/github/create.blade.php b/resources/views/livewire/source/github/create.blade.php
index f47575784..7681e0fd9 100644
--- a/resources/views/livewire/source/github/create.blade.php
+++ b/resources/views/livewire/source/github/create.blade.php
@@ -13,6 +13,11 @@
                 <x-forms.checkbox id="is_system_wide" label="System Wide"
                     helper="If checked, this GitHub App will be available for everyone in this Coolify instance." />
             </div>
+            @if ($is_system_wide)
+                <x-callout type="warning" title="Not Recommended">
+                    System-wide GitHub Apps are shared across all teams on this Coolify instance. This means any team can use this GitHub App to deploy applications from your repositories. For better security and isolation, it's recommended to create team-specific GitHub Apps instead.
+                </x-callout>
+            @endif
         @endif
         <div x-data="{
             activeAccordion: '',