> or at least we couldn't find a way to specify them as "read" in our very limited time You didn't miss anything - GitHub repo permissions are pretty much all-

> or at least we couldn't find a way to specify them as "read" in our very limited time You didn't miss anything - GitHub repo permissions are pretty much all-or-nothing. We've been putting up with this for two years at CircleCI :( [For others, to read from a private repo, you need to request the "repo" scope, which actually gives read+write access to every repo in every org that you have access to. See https://circleci.com/docs/github-permissions https://circleci.com/docs/github-permissions for more details.]