SideButton for GitHub: review on the pull request, not in a dashboard
SideButton runs cloud coding agents that open pull requests. Install the Kadmo AI GitHub App and the conversation on those pull requests reaches them: a reviewer mentions the agent, and when the session that authored the PR is still running the comment arrives as its next turn — same context, same branch, an answer on the PR itself. When the session has ended, the same rule starts a fresh job that knows what came before.
What the GitHub integration does
The session keeps going
A mention on a PR whose authoring session is still live arrives as that session’s next user turn — not a new job with a cold start. The agent still has the branch, the diff and the reasoning that produced it.
Rules, not a firehose
Filter on repository, event, mention, review verdict, merge outcome and base branch. No rule is seeded and nothing is automatic: an installation with no rule delivers events and does nothing with them.
A trust floor on comments
Anyone can comment on a public PR, so rules require the commenter to be a repository collaborator by default. An unknown association ranks lowest and is refused rather than waved through.
Every delivery is on the record
Matched, dispatched or skipped-with-a-reason — each evaluation writes a log row carrying the pull request, the commenter and their association. "Why did nothing happen?" is a question with an answer.
How it works
The App delivers pull-request events to SideButton over a signed webhook. An automation rule you write decides what happens: filter by repository, event, mention, comment-author trust level, review verdict, merge outcome or base branch. A match either continues the PR’s live session or dispatches a workflow on the workspace holding that repository. Every evaluation is logged — matched, dispatched, or skipped with the reason.
The distinction that matters is between continuing and restarting. A pull request that is still being worked on belongs to a running session, and a review comment is the next thing that session should hear — so it is delivered there, with the author, their repository association and a link to the comment attached, and the agent answers on the pull request. Only when that session has finished does a rule fall back to starting a new job, carrying the previous one forward so the new agent knows what came before.
Set it up
Open Integrations in the SideButton portal, find the GitHub card and install the Kadmo AI App on your organisation, choosing all repositories or a subset. An organisation owner approves the install. Then follow the card’s New mention rule link, which opens the automations form pre-filled for PR mentions; review the filters and save. Nothing runs until you save that rule.
1. Connect GitHub
On /portal/integrations, open the GitHub card and save a personal access token. This is the outbound half — what agents push with — and it is also the identity that acknowledges comments on a pull request. Use a dedicated agent account, not your own.
2. Install the Kadmo AI App
In the same card, open the GitHub App section and choose Install. GitHub asks an organisation owner to approve it for all repositories or a chosen subset. You are returned to the portal, which links the installation to your account.
3. Open the pre-filled rule
The card shows a New mention rule link once the App is installed. It opens the automations form filled in for pull-request mentions of your connected identity, with continue-the-session and a 👀 acknowledgement switched on. Nothing is saved until you save it.
4. Review the filters and save
Narrow the repositories, pick the events you want (comments, reviews, PR opened, updated, closed), and confirm the minimum comment author. Save the rule. That save is the opt-in — before it, the installation does nothing.
5. Mention the agent on a real pull request
Comment on a PR an agent opened and watch the reply arrive on the PR. The rule’s detail page shows the delivery: which rule matched, whether it continued a live session or queued a job, and the reason for anything it skipped.
Requirements
- A SideButton account, on the free trial or any paid plan.
- A GitHub organisation, and an owner who can approve the App install.
- A dedicated GitHub agent user, whose token the portal stores. Connecting a person’s account works, but that person then cannot summon the agent by mention.
- At least one cloud agent online, and a workspace with the repository attached — a rule that matches a repository no workspace holds has nowhere to send the work.
Access and permissions
The Kadmo AI App requests four permissions, which GitHub shows in full on the install screen before an owner approves: read access to repository metadata, and write access to contents, issues and pull requests. You choose whether it applies to every repository or only the ones you select, and that choice is the first filter every rule inherits.
Every delivery is signature-verified against a secret held by the platform, deduplicated on GitHub’s delivery id, and bound to exactly one account through the installation — an event can never reach an account that does not own the installation it came from. Uninstalling on GitHub, or unlinking in the portal, stops inbound events immediately.
For a security review ahead of an install, or anything the FAQ below does not cover, write to [email protected].
Frequently asked questions
Does installing the App make agents start acting on comments?
No. Installing wires the transport, not the behaviour. Until you save an automation rule, an installation receives events, records a last-delivery time, and advances the merge gate of a merged agent pull request. Nothing else. That is deliberate: a mention hands text written by someone else to a session holding your credentials, so it is an explicit opt-in.
Can I @-mention the app itself?
Not in the way GitHub means it. GitHub Apps cannot be mentioned — no autocomplete, no notification. That is a platform limitation shared by every app of this kind. Rules match a handle by reading the comment body instead, which is why the usual setup mentions your connected agent user, whose @handle does autocomplete and notify.
What stops a stranger from steering an agent on a public repository?
A minimum-comment-author floor, set to repository collaborator by default, plus the rule itself being opt-in, a per-account kill switch, and a full log of every evaluation. Comments are framed to the agent as review feedback, never as instructions to act outside the repository. You can raise the floor to organisation member or owner.
Why does the agent ignore my own comments?
Because the connected GitHub identity is treated as the agent’s own voice, and its comments never trigger rules — otherwise an agent would answer itself. If you connect a person’s GitHub account, that person cannot summon the agent by mention. Connect a dedicated agent user and the problem disappears.
Do agents merge pull requests?
No. Agents open and update pull requests; merging stays a human action or a review gate you configure. What the App adds on merge is bookkeeping — a merged agent PR advances its gate from the webhook within about a minute instead of waiting for a polling timer.
Does this work with GitLab or Bitbucket?
Not yet — the inbound lane is GitHub only, because neither host has app-level webhook delivery. Events there would need a hook registered on every project through your own credential, which is designed but not built. Outbound differs between the two as well: on GitLab agents clone, push and open merge requests using a token your operator places on the agent, while Bitbucket today is a read-only connection — the portal delivers no credential to agents for it.
Keep the review where the code is
Install the App, save one rule, and the next comment on an agent’s pull request gets an answer on the pull request.
Related
- Linear integration routes issues to the agents that open these pull requests.
- SideButton MCP server is the open-source engine the agents run on.
- Documentation covers installation and first steps for the rest of the platform.