8 days ago
Hi,
I'm experiencing a recurring issue where my service's GitHub repo reference is automatically changing without my manual intervention. This has happened 2-3 times.
What happened:
The repo reference changed to an invalid project that exists on GitHub. This broke deployments.
Issue:
- Occurred 2-3 times automatically, not manual mistakes
- The repo configuration changes without anyone editing it in the dashboard
Impact:
- Deployments fail when the repo reference is wrong
- Unpredictable service behavior
- Concerned about account security/integrity
Please investigate it properly.
This needs to be resolved to ensure my service deployments remain stable and predictable.
Thanks
1 Replies
8 days ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • 8 days ago
8 days ago
Check GitHub App permissions
GitHub → Settings → Applications → Installed GitHub Apps → Railway. Under "Repository access," it should list only the specific repos you need — not "All repositories." If "All repositories" is selected, Railway can see and potentially link to unrelated repos. Switch it to "Only select repositories."
2
Check for a reused/recycled repo ID
This is the most common cause: if a repo with the same name was previously deleted or renamed, GitHub may reassign that name/ID to a different (invalid) repository. Since Railway tracks the source by repo ID, it can end up silently pointing at the wrong repo now using that old identifier. Fix: fully disconnect the service's source, then manually reselect the correct repository.
3
Check webhooks and integrations
In the GitHub repo → Settings → Webhooks, look for any webhook that isn't Railway's, or another CI/CD integration (Zapier, a GitHub Action, another bot) that could be programmatically changing the source via Railway's API.
4
Review the Railway project's activity log
Railway dashboard → project → Settings → Activity (or Audit Log, if available). This shows exactly when and by whom/which token the source was changed — revealing whether it was human error or an automated process.
5
Review and rotate API tokens
A project or account token may have leaked, or be left over in an old integration. In Railway → Account/Project Settings → Tokens, review every token, delete unused ones, and rotate any that look suspicious.
6
Reconnect the source and lock it down
Once the cause is found, go to Service → Settings → Source and explicitly reselect the correct repo and branch. If automatic redeploys aren't needed on every push, restrict the deploy trigger to just the intended branch — this reduces the chance of unexpected automatic changes.