Storage location

Comments can live in the same repository that runs the comment system, or in a separate one. COMMENTS_REPO decides; there is no extra switch.

COMMENTS_REPO=owner/comments-repo   # recommended
COMMENTS_REPO=owner/gitpigeon    # same repo as the service

Prefer a separate repository

Both work, but they are not equivalent.

1. Blast radius

• Separate repo: a leaked PAT can write junk files into the comments repo
• Same repo: a leaked PAT can push code into the repository that runs this function. Platform Git integration redeploys, and the attacker gains the runtime with every environment variable, including GITHUB_TOKEN and COMMENTS_SECRET

2. Self redeploys

Git integration watches pushes, not code changes. Every approval triggers a rebuild. Harmless, but it burns build minutes.

Ways to skip the rebuild:

Platform	Mechanism
Vercel	Ignored Build Step that skips when only comments/ changed
Netlify	ignore build command with the same check
Cloudflare Pages	Build watch paths excluding comments/*
Cloudflare Workers (wrangler)	No Git integration, no rebuild at all

3. Hard rule

Builds must never write back to the repository. Writes happen only in the approve action. Otherwise same-repo mode becomes an infinite deploy loop.

Same-repo warning

Set SELF_REPO to receive sameRepo: true plus a warning from /api/health. Leave it unset to skip the comparison.

Transparent to clients

Same or separate, private or public: the widget configuration is identical. Only the server-side COMMENTS_REPO changes.