I am trying to give access to clone only without push. I know how to create the personal access token and created, but the thing is, I am not not sure what scope to choose from.
I pretty much tried all four, one by one and even selecting all does not work. (somehow selecting repo which will automattically check all the other 4 would work but this would give total access. I read the documenation about the scopes https://developer.github.com/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/ which doesn't really help me understanding it much.
repo Full control of private repositories
repo:status Access commit status
repo_deployment Access deployment status
public_repo Access public repositories
repo:invite Access repository invitations
Would only need clone access and nothing else.
Thanks in advance for any help suggestions.
You cannot restrict a personal access token to read-only access on GitHub. You'll need to use a deploy key and SSH in order to provide read-only access. Note that deploy keys can also have push access, so make sure you don't check that box.
Related
I am currently trying out Netlify function and using Netlify-cli to setup the CD. In the authorizing options, I picked the GitHub Personal Access Token and I want to know if the Full control of private repositories scope will include the private repos in the organization that I am apart of as I don't want it to access the repos in the organization.
The scope has a few implications and you should probably look at a user specific role for setting up access tokens without giving access to a user (yourself) as the owner of the org repositories you have.
Create a (machine) user that has access to only the one repository or repositories (private) that would limit the access to these repositories or an organization repository. Since private tokens have read/write access this is a prudent approach to making sure you're limiting access to other repositories using the token.
If at a later time this changes on Github, this will no longer be needed. It is the approach I have used to limit my exposure to a leaked token or access.
I have project on Github of which I need help with. It started out as a personal project and now evolved to me incorporating a company and hiring someone. How can I give this person access so that they cannot delete anything and only I will be allowed to accept their code changes or not?
This is a personal github account and the repository is private.
Since the account is a personal account, you will be the owner unless you explicitly transfer ownership. Anyone you give access to will be a collaborator. They cannot access repository settings, add or remove collaborators, or delete the repository, for instance.
However, GitHub does not provide fine-grained permission controls for collaborators of repositories from personal accounts. You cannot prevent them from having write access. This help page provides a list of things collaborators can do in the repository.
You can (partly) achieve what you want by protecting your master branch and requiring reviews for pull requests.
For more fine-grained access control, you could create an organization account and transfer the repository there, and keep yourself as the sole user with admin permissions. You can then give your collaborator only read permissions.
Objective: Allow different clients access to only read/pull from my private repo.
Overview:
Listed are the different options that I am aware of:
I could invite the clients and give them access to the Basic access level but do know what to have to pay for different users just to read/clone from the repo.
I could create a single user with Basic access level and then create git access tokens for them individually. However, I did not see a way to restrict the access tokens to be project/repo specific. Instead, the access tokens create had the same privileges as the created user.
Question: What is the best practice to provide access to an external user to only access the private Azure DevOps repo?
Note: I have seen this link and did not know if there were other options.
To make the user only have read access to all repos in one project:
You may consider making the user a reader instead of contributor or Project Administrators, so the user can have only read access to the repos in one project.
Organization Settings=>Users(General)=>Manage user=> select Project reader.
More details about project readers you can check this document.
To make the user only have read access to one special repos in one project:
We can control related permissions from Project Settings=>Repositories(Repos)=>Version Control Administrators:
Hope all above helps :)
I am creating a public repository to create resource library. As it is initial phase of the project I want to create certain issues that only the collaborators have full access. Is it possible? If not what is the way that will serve the purpose?
Yes, it has
you can Invite collaborators for working in your repo, also you can give different access permission for everyone.
its clearly explained over here
We have an web application, which lets the user write code and store it in an internal git repository on our server.
Now we wanted to allow the user to share his code with his github repository. So we looked through the api documentation of github and found a way via ouath2.
However to make this work, we need to request write access from the user, but github oauth access scopes only include write access to all repository of an user, which is way too much for us.
Is it possible to restrict an api access for only one specific repository of an user?
As per jasonrudolph comment, it is not currently possible to restrict API access to a specific repository.
Deploy keys are the closest thing that provides this type of functionality. (This won't help you from an API perspective, but a deploy key might meet your underlying need.) If your application were to generate an public/private SSH keypair, and the user were to add the public key as a deploy key in the repository, then you could use the private key to access just that one repository (without having access to the user's other repositories).