I'm building a CLI which triggers an Action (using workflow_dispatch) in my repository. I'm using Github API to perform this task. Taken from the docs:
You must authenticate using an access token with the repo scope to use this endpoint.
I've generated a PAT with repo scope to authenticate myself. I want users to run this CLI. Is it safe to share this PAT (which has repo as the only scope)?
p.s. I know it is ironical to ask if "Personal"-access-token can be "shared". But I don't see any problem it can cause with its limited scope.
I don't think it is a good idea. Repo scope is not limited to only one repo.
If you want to trigger actions by external users, your best bet would probably be to create a workflow running on PR or Issue events.
Allow your users to create issues
Monitor keywords or label on the issue
Trigger your action.
Related
I'm reading the documentation on Scopes for OAuth Apps and it's not clear to me if it's possible to grant read access to private repos, without providing write access.
The repo scope grants full access to read and write everything. This works but it's more permissive than what we would like.
The scope public_repo is only for public repos as its name suggests, and I'm not sure if read:repo_hook is what I need or not.
What's the best suited scope for my use case of reading pull request by passing a commit hash as a parameter to Octokit?
For OAuth apps, the most granular scope is repo or public_repo, depending on whether you need access to all repositories or only public ones.
If you want more granular permissions, you need to use GitHub Apps, which also have OAuth featues (GitHub calls these user-to-server tokens):
https://docs.github.com/en/developers/apps/building-github-apps/identifying-and-authorizing-users-for-github-apps.
GitHub Apps need to be installed by users on repositories in order to grant access, and they have a pull_request read or write permission, depending on what you need.
I am writing a Github App that is able to create repositories in an installation.
When the App acts on behalf of an authenticated user, I would like to check that the user can (by themselves) create a repository in the org.
I have spent a lot of time on GitHub's API docs, but I cannot find the answer.
My first thought was that this info should be available in the endpoint /user/installations. The endpoint lists the installations that the user can access (either as a member of an organization or as an external collaborator). However, the permissions returned with each entry are actually the permissions for the App, not for the user. So, this is a dead end.
Another direction was looking at the (public+private) organizations of the user using /user/orgs.
(This does not seem the right direction because as an App I would expect to operate only on installations...)
With this endpoint, I can get all the organizations of the user. However, I don't get whether they can create repos and/or what the role of the user is in the organization.
Should I use the teams/roles part of the API?
My App doesn't ask for the members suite of permissions so I would like to avoid this road.
At this point, the only workarounds are:
Try to create the repo as the user, take note if it fails. Bad solution because I don't want to tell the user that they can create a repo if they can't.
In the background, try to create a repo as the user to check if it possible. If it is, delete the repo. This works but it seems an ugly workaround.
Any suggestion?
I am tasked to help automate the workflow related to automating a few tasks related to management of our organization account on GitHub. For example, add and remove users from the org, create new repos, add external collaborators etc. The requests for this actions will come from a system where a user fill in a form and this system will curl to the GitHub API after the request is reviewed and approved.
By reading the GitHub API documentation I can set up the curls for this, but I am unsure about authentication best practices. My first idea would be to create a user account specific for this use case, make it admin for the org, and create an OAuth token with scopes needed to be allowed to make this requests. However, it feels a bit too hacky to create an individual account for something that is not an individual, and then make it admin of the whole organization.
Is there a better way to approach this?
We've set up a Github app so that it automatically forks a repository for another individual Github user using the Github API. Now we're running into a problem that not everyone wants to give us full read access to all of their private repositories since sometimes they contain sensitive data.
Is there a way to only get read/write permission to a single repository and not the individual's entire account?
Unfortunately, this is not available yet. This feature is still under development as you can see in the Gihub Apps roadmap (and note that I am talking about Github Apps, not OAuth Github Apps). I don't know if this will ever be possible in OAuth Apps but it seems that it might in Github Apps.
There is already a discussion about this at the dear github repository. You should check for news there.
Is there a way to only get read/write permission to a single repository and not the individual's entire account?
Not that I know of: it is easier to setup a new dedicated GitHub account where you would recreate the private repos you want to give access to.
In that new account, you can consider all the private repos can be accessed.
You would keep the really private ones (with sensitive information) in your original GitHub account.
I believe you're looking for X-OAuth-Scopes. This is a well-defined header so that you may restrict your access scope to, for example, public repositories only.
The github developer documentation here says:
... space-delimited list of scopes. If not provided, scope defaults to an empty list for users that have not authorized any scopes for the application. For users who have authorized scopes for the application, the user won't be shown the OAuth authorization page with the list of scopes. Instead, this step of the flow will automatically complete with the set of scopes the user has authorized for the application. For example, if a user has already performed the web flow twice and has authorized one token with user scope and another token with repo scope, a third web flow that does not provide a scope will receive a token with user and repo scope.
I'd like to use the GitHub API to read comments, issues and so on for a given user with the GitHub Events API.
I've already accomplished that with OAuth authentication using the repo scope. That's a big overkill since I just want to read events and this scope grants almost everything. The API doc doesn't specify anything, and I can't find a more limited scope.
I've been testing with different personal access token scopes but only repo makes requests return private events.
You will need to use the scope repo if you want to retrieve events originating from private repositories.
At this point this is the only scope for the job.