I think that's how GitHub OAuth works though. As far as I know, you can't ask for access to a specific repository for an account, just access to private reposit

I think that's how GitHub OAuth works though. As far as I know, you can't ask for access to a specific repository for an account, just access to private repositories in general. You could probably hack around it by creating an integration account that only has access to the repositories that you want to integrate. If you're asking for only access to the Gemfile and not the repository, that's far outside the security model of GitHub, and even Git. Maybe a good alternative for people security conscious would be a manual Gemfile upload?