fix(github-app): complete the self-managed setup instructions, render the page header (#10683)

* docs(github-app): state the pull-direction permissions and the App owner field

The in-product "How to create a GitHub App" panel only listed Contents and
Metadata, which covers the push direction of git sync. Webhooks, pull requests
and checks are what the git to Windmill direction needs, and a GHE Cloud
(*.ghe.com) app also needs App owner, whose field hint was the only place
saying so.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(instance-settings): render the GitHub App page header

The branch tested the pre-rename category name, so the page rendered with no
header at all. Naming the header after the category duplicates the card
below it, so the card that holds the app credentials is now labelled for what
it is, next to the webhook base url card.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

frontend/src/lib/components/InstanceSettings.svelte

@@ -1144,10 +1144,11 @@
 				description="Configure where secrets (secret variables) are stored."
 				link="https://www.windmill.dev/docs/core_concepts/workspace_secret_encryption"
 			/>
-		{:else if category == 'GitHub Enterprise App'}
+		{:else if category == 'GitHub App'}
 			<SettingsPageHeader
-				title="GitHub Enterprise App"
-				description="Configure a self-managed GitHub App for GitHub Enterprise Server git sync."
+				title="GitHub App"
+				description="Configure a self-managed GitHub App for git sync on GitHub.com, GHE Cloud or GitHub Enterprise Server."
+				link="https://www.windmill.dev/docs/integrations/git_repository#self-managed-github-app"
 			/>
 		{:else if category == 'DB Health'}
 			<SettingsPageHeader

frontend/src/lib/components/instanceSettings.ts

@@ -1005,9 +1005,11 @@ export const settings: Record<string, Setting[]> = {
 	],
 	'GitHub App': [
 		{
-			label: 'GitHub App',
+			// The category header above already names the section; this labels the
+			// card that holds the app credentials, next to the webhook base url one.
+			label: 'App configuration',
 			description:
-				'Configure a self-managed GitHub App to enable git sync without stats.windmill.dev.',
+				'Use your own GitHub App instead of the Windmill-managed one on stats.windmill.dev.',
 			key: 'github_enterprise_app',
 			fieldType: 'github_enterprise_app',
 			storage: 'setting',

frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte

@@ -194,13 +194,34 @@
 					<li>
 						<strong>Callback URL</strong>: <code>&lt;your-windmill-url&gt;/gh_success</code>
 					</li>
-					<li>Uncheck <strong>Active</strong> under Webhook (not needed)</li>
+					<li>
+						Uncheck <strong>Active</strong> under Webhook. Windmill registers the webhooks it
+						needs per repository, so the app-level webhook stays unused.
+					</li>
 				</ul>
 				<p><strong>3.</strong> Set repository permissions:</p>
 				<ul class="list-disc ml-4 space-y-1">
 					<li><strong>Contents</strong>: Read &amp; write</li>
 					<li><strong>Metadata</strong>: Read-only</li>
 				</ul>
+				<p>
+					Those two are the minimum, for the push direction (Windmill &rarr; git). Add these for
+					the pull direction (git &rarr; Windmill), all read &amp; write:
+				</p>
+				<ul class="list-disc ml-4 space-y-1">
+					<li>
+						<strong>Repository webhooks</strong>: deploy commits within seconds instead of
+						polling the repository
+					</li>
+					<li>
+						<strong>Pull requests</strong>: open pull requests for the branches Windmill pushes,
+						and maintain the deploy-preview comment
+					</li>
+					<li>
+						<strong>Checks</strong>: post the "Windmill diff" and deploy status checks on commits
+						and pull requests
+					</li>
+				</ul>
 				<p>
 					<strong>4.</strong> Under "Where can this GitHub App be installed?", choose
 					<strong>Any account</strong> (or restrict to your organization).
@@ -219,7 +240,18 @@
 				</p>
 				<p>
 					<strong>8.</strong> The <strong>Base URL</strong> is your GitHub instance root (e.g.
-					<code>https://github.com</code> or <code>https://github.mycompany.com</code>).
+					<code>https://github.com</code>, <code>https://mycompany.ghe.com</code> or
+					<code>https://github.mycompany.com</code>). On GHE Cloud (<code>*.ghe.com</code>), also
+					set <strong>App owner</strong> to the organization or user that owns the app: its
+					installation urls carry the owner.
+				</p>
+				<p>
+					Full setup guide: <a
+						href="https://www.windmill.dev/docs/integrations/git_repository#self-managed-github-app"
+						target="_blank"
+						rel="noreferrer"
+						class="underline">Self-managed GitHub App</a
+					>.
 				</p>
 			</div>
 		</details>