From 6df37ee16760dfbf498effc6ced80f7ee0b33af3 Mon Sep 17 00:00:00 2001
From: Yggdrasil <yggdrasilworld@users.noreply.github.com>
Date: Wed, 14 Oct 2026 03:00:29 -0400
Subject: [PATCH] =?UTF-8?q?docs(env):=20document=20GITHUB=5FSYNC=5FALLOWED?=
 =?UTF-8?q?=5FREPOS=20=E2=80=94=20required=20for=20new-repo=20sync?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The var gates every first-time sync via RepoScopeGuard but was never in
.env.example or the README, so a fresh setup couldn't sync any repository.

Resolves #566
---
 .env.example | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.env.example b/.env.example
index 7913f204..9963c25d 100644
--- a/.env.example
+++ b/.env.example
@@ -38,6 +38,12 @@ GITHUB_OAUTH_CALLBACK_URL=http://localhost:3000/api/auth/github/callback
 # TODO: migrate to a GitHub App installation token flow for multi-org support.
 GITHUB_API_TOKEN=
 
+# Comma-separated "owner/repo" allowlist for first-time syncs — a repository
+# must be listed here (or already have an assigned maintainer) before it can
+# be synced, otherwise RepoScopeGuard refuses it (#566). Required to sync any
+# new repository.
+GITHUB_SYNC_ALLOWED_REPOS=
+
 # --- GitHub Webhooks -------------------------------------------------------
 # Secret configured on the GitHub repo/organization webhook. Used to verify
 # the `X-Hub-Signature-256` HMAC-SHA256 header on every incoming webhook.