4 ms·
> - It only says "access to code repositories" (it does not say anything about the level of that access, it might as well mean write access, capability to trigg
by IanCal 4y ago
> - It only says "access to code repositories" (it does not say anything about the level of that access, it might as well mean write access, capability to trigger actions etc.)
Given the exceptionally broad granularity of github permissions with oauth at least I'd be concerned. I've repeatedly had to avoid using something because while I wanted to grant permission to, say, read one particular repo I'd have to allow write access to all private repos. Githubs solution is to give broad access to a user that has limited access, although then they shout at you for creating more users if you're not a paying member yourself (but may be in an organisation).
https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps https://docs.github.com/en/developers/apps/building-oauth-ap...
- e1g 4y agoGitHub recently introduced fine-grained tokens that can be scoped to a single repository that might work for your use-case https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/ https://github.blog/2022-10-18-introducing-fine-grained-pers...
- ChymeraXYZ 4y agoUnfortunately this only seems to be available for repos you own yourself and not if an org owns the repo, making it useless in a company context until that is expanded. Great for personal stuff tho.
- drothlis 4y agoFine-grained access tokens are available on org-owned repos too, but the org has to opt in (for some reason).
- e1g 4y agoThey work, but the organization needs to approve the token (and its scope). As an org admin, I prefer it this way because I can audit what access developers give out to what repositories. The new tokens are still in Beta, so there are some other limitations: for example, GitHub Packages do not support them yet, so you cannot use them in NPM/yarn to get your private packages hosted on GitHub.
- Aeolun 4y agoDoesn't this rather defeat the point? If using a PAT is simpler than using the org token then I'll just use a PAT that has access to every single repository in the org.
- e1g 4y agoGitHub Org admins have the option to block all regular PATs, and only allow fine-grained tokens that they pre-approve. This block is “off” by default, but I expect the best practice soon will be to enforce this rule.
- Aeolun 4y agoOh, aside from the pre-approval, that would be really nice. I need stuff scoped to the org that is not necessarily connected to my personal account (and all it’s repositories).
- likeclockwork 4y agoGitLab has had this feature for years.
- twistedpair 4y agoI'm excited for FGPATs, but they're still in beta and still have a lot of shortcomings at this time.
- awinter-py 4y agooverbroad roles + permissions is such a problem on every platform. github surprisingly bad given their technical sophistication overall on my long-term wishlist: a standard way to aspirationally reduce your permissions footprint like if I'm a twitter plugin, and I need one operation for which there is only a broad permission, I request the broad permission ('read and write everything'), but include an optional manifest making it clear that I only need the one action ('add followers') this 1) enables a linter ecosystem to verify my footprint is narrower than it seems, and 2) over time lets the platform tailor offer narrower perms based on observed use-cases permissions matter bc users can audit them more easily than code