You can now sign in to ZAR with Continue with Google, right next to the existing GitHub option.
This is a sign-in convenience, not a change in how ZAR works. ZAR is a GitHub App, so GitHub is still required to actually use it. Google is simply another door into your account.
What changed
The login screen now offers two ways in:
- Continue with GitHub as before.
- Continue with Google as a new option.
If you already have an account, you can use whichever you prefer. Both land you in the same place.
GitHub is still required
ZAR connects to your repositories through the GitHub App. Without that connection, there is nothing for ZAR to watch and no PR to comment on.
So if you sign in with Google and have not connected GitHub yet, ZAR prompts you to connect it. Google gets you into your account. GitHub is what lets ZAR do its job.
No duplicate accounts
A common annoyance with multiple sign-in methods is ending up with two accounts for the same person. We avoid that by linking on verified email.
If your Google email matches the email already on your account, you land in that same account. You do not get a second, parallel one. Sign in with GitHub one day and Google the next, and it is still you.
How the sign-in is verified
A login button is only as good as what happens behind it. The Google flow does the checks you would expect:
- The Google ID token is verified before we trust any identity from it.
- A CSRF state parameter is checked on the callback to make sure the response belongs to a request you actually started.
- Account linking keys off the verified email, not a self-asserted one.
Should you switch
There is nothing to migrate. If GitHub sign-in works for you, keep using it. If you would rather use Google, the option is there now, and it resolves to the same account either way.
The one thing that has not changed, and will not, is that ZAR needs the GitHub connection to read your code and post in your pull requests. Google is just a faster way to reach the front door.