GitHub App sign-in for the Product Hunt launch, Free plan unlocks and Managed AI admin

.dockerignore

@@ -104,3 +104,6 @@ Makefile*
 docker-compose.yml
 docker-compose.*.yml
 docker/docker-compose.*.yml
+
+# GitHub App private key - never bake into images
+*.pem

.env.example

@@ -56,6 +56,7 @@ LIVEREVIEW_IS_CLOUD=false
 # Cloud authentication (required when LIVEREVIEW_IS_CLOUD=true)
 # CLOUD_JWT_SECRET=your_cloud_jwt_secret_here
 # FW_PARSE_ADMIN_SECRET=your_parse_admin_secret_here
+# FW_PARSE_BASE_URL="https://parse.domain.com"
 
 # Discord webhook for signup notifications (Cloud Only)
 # DISCORD_SIGNUP_WEBHOOK_URL=https://discord.com/api/webhooks/...
@@ -96,3 +97,15 @@ LIVEREVIEW_IS_CLOUD=false
 # RAZORPAY_LIVE_LOW_PRICING_YEARLY_PLAN_ID_USD=plan_xxxxxxxxxxxxxx
 # RAZORPAY_LIVE_LOW_PRICING_MONTHLY_PLAN_ID_INR=plan_xxxxxxxxxxxxxx
 # RAZORPAY_LIVE_LOW_PRICING_YEARLY_PLAN_ID_INR=plan_xxxxxxxxxxxxxx
+
+# =============================================================================
+# GitHub App - "Continue with GitHub"
+# =============================================================================
+
+# GITHUB_APP_ID=your_github_app_id_here
+# GITHUB_APP_ID=538xxxx
+# GITHUB_APP_SLUG=livereview-agent
+# GITHUB_APP_CLIENT_ID=Iv2xxxxxxxxxxxxxxxx
+# GITHUB_APP_CLIENT_SECRET=45665xxxxxxxxxxxxxxxxxxxxx
+# GITHUB_APP_WEBHOOK_SECRET=your_github_app_webhook_secret
+# GITHUB_APP_PRIVATE_KEY='-----BEGIN RSA PRIVATE KEY----xxxxxxuy\n-----END RSA PRIVATE KEY-----'

.gitignore

@@ -96,3 +96,6 @@ scripts/prelivi/.venv/
 email-preview
 email-preview.html
 livereview.dtx
+
+# GitHub App private key (GITHUB_APP_PRIVATE_KEY)
+*.pem

Dockerfile

@@ -4,7 +4,7 @@
 # Frozen Docker dependency versions - see docker/docker-deps.env (single source of truth).
 # scripts/lrops.py injects these as --build-arg for every build.
 ARG NODE_IMAGE_TAG=20.20.2-alpine
-ARG GOLANG_IMAGE_TAG=1.26.9-bookworm
+ARG GOLANG_IMAGE_TAG=1.26.10-bookworm
 ARG DEBIAN_IMAGE_TAG=trixie-20260824-slim
 
 # Stage 1: Build React UI

Dockerfile.crosscompile

@@ -5,7 +5,7 @@
 # Frozen Docker dependency versions - see docker/docker-deps.env (single source of truth).
 # scripts/lrops.py injects these as --build-arg for every build.
 ARG NODE_IMAGE_TAG=20.20.2-alpine
-ARG GOLANG_IMAGE_TAG=1.26.9-bookworm
+ARG GOLANG_IMAGE_TAG=1.26.10-bookworm
 ARG DEBIAN_IMAGE_TAG=trixie-20260824-slim
 
 # Stage 1: Build React UI once (architecture-agnostic)

db/migrations/20261020090000_github_app_installations.sql

@@ -0,0 +1,12 @@
+-- migrate:up
+-- One GitHub App installation can belong to exactly one LiveReview org.
+CREATE UNIQUE INDEX IF NOT EXISTS uq_integration_tokens_github_app_installation
+    ON integration_tokens (provider_url, provider_app_id)
+    WHERE token_type = 'GITHUB_APP';
+
+-- How the org was created; 'gh_app' for orgs created through /gh-login. Analytics + onboarding banner only.
+ALTER TABLE orgs ADD COLUMN IF NOT EXISTS signup_path TEXT;
+
+-- migrate:down
+DROP INDEX IF EXISTS uq_integration_tokens_github_app_installation;
+ALTER TABLE orgs DROP COLUMN IF EXISTS signup_path;

db/migrations/20261022120000_managed_ai_gemini3_vertex.sql

@@ -0,0 +1,24 @@
+-- migrate:up
+-- Google retired Gemini 2.5 Flash / Flash-Lite on Vertex AI on 2026-10-20. The managed tiers run on Gemini Enterprise
+-- (Vertex AI), so the earlier bumps (which matched provider_name = 'gemini') never applied to them.
+-- Gemini 3.x is only served from the global and us/eu multi-region locations, so the tier also records its location.
+ALTER TABLE system_default_ai_configs ADD COLUMN IF NOT EXISTS gcp_location TEXT;
+
+UPDATE system_default_ai_configs
+SET model_name = 'gemini-3.8-flash', gcp_location = 'us', updated_at = CURRENT_TIMESTAMP
+WHERE tier_name = 'default' AND provider_name = 'gemini-enterprise' AND model_name = 'gemini-2.5-flash';
+
+UPDATE system_default_ai_configs
+SET model_name = 'gemini-3.5-flash-lite', gcp_location = 'us', updated_at = CURRENT_TIMESTAMP
+WHERE tier_name = 'default_lite' AND provider_name = 'gemini-enterprise' AND model_name = 'gemini-2.5-flash-lite';
+
+-- migrate:down
+UPDATE system_default_ai_configs
+SET model_name = 'gemini-2.5-flash', updated_at = CURRENT_TIMESTAMP
+WHERE tier_name = 'default' AND provider_name = 'gemini-enterprise' AND model_name = 'gemini-3.8-flash';
+
+UPDATE system_default_ai_configs
+SET model_name = 'gemini-2.5-flash-lite', updated_at = CURRENT_TIMESTAMP
+WHERE tier_name = 'default_lite' AND provider_name = 'gemini-enterprise' AND model_name = 'gemini-3.5-flash-lite';
+
+ALTER TABLE system_default_ai_configs DROP COLUMN IF EXISTS gcp_location;

db/migrations/20261022130000_managed_ai_configs_admin.sql

@@ -0,0 +1,21 @@
+-- migrate:up
+-- Managed AI admin page: a tier can hold several configurations (e.g. the old Vertex one and a new OpenRouter one),
+-- exactly one of them active. GetSystemManagedConfig reads only the active row.
+ALTER TABLE system_default_ai_configs DROP CONSTRAINT IF EXISTS system_default_ai_configs_tier_name_key;
+CREATE UNIQUE INDEX IF NOT EXISTS uq_system_default_ai_configs_active_tier
+    ON system_default_ai_configs (tier_name)
+    WHERE is_active;
+ALTER TABLE system_default_ai_configs ADD COLUMN IF NOT EXISTS label TEXT;
+ALTER TABLE system_default_ai_configs ADD COLUMN IF NOT EXISTS updated_by_user_id BIGINT;
+
+-- Orgs created through /gh-login?src=launch-trial may run reviews on the LiveReview model while on the Free plan.
+ALTER TABLE org_billing_state ADD COLUMN IF NOT EXISTS free_managed_ai_granted_at TIMESTAMPTZ;
+
+-- migrate:down
+ALTER TABLE org_billing_state DROP COLUMN IF EXISTS free_managed_ai_granted_at;
+ALTER TABLE system_default_ai_configs DROP COLUMN IF EXISTS updated_by_user_id;
+ALTER TABLE system_default_ai_configs DROP COLUMN IF EXISTS label;
+DROP INDEX IF EXISTS uq_system_default_ai_configs_active_tier;
+-- Inactive rows have to go before the per-tier uniqueness can come back.
+DELETE FROM system_default_ai_configs WHERE NOT is_active;
+ALTER TABLE system_default_ai_configs ADD CONSTRAINT system_default_ai_configs_tier_name_key UNIQUE (tier_name);