> I'm not even sure if Github's permission model supports adding only read access to private repositories. Their newer GH apps permission model allows fine-gra

> I'm not even sure if Github's permission model supports adding only read access to private repositories. Their newer GH apps permission model allows fine-grained access to only specific repos (and also only read access e.g.). However their older Oauth flow only allows full access to everything. And 99% of GH integrations still seem to use the older authentication method. This is also something that many CI providers suffer from. There are only few that already support GH apps.