4 ms·

Yeah, understood that this could be an issue for people. I'd like to at least be able to split out granting access to public / private repos - although write to

Yeah, understood that this could be an issue for people. I'd like to at least be able to split out granting access to public / private repos - although write to public could still be an issue.. What do you mean by creating PRs automatically instead?

frabcus 12y ago
You could always fork repos to your own robot account, and then do the pull request from there.
- JangoSteve 12y ago
  If your repo is private, then they'd either need a really large paid account and pay for the private fork they create of your repo, or they'd have to fork your repo as a public repo. Obviously neither is really an option. EDIT: Unless you mean just doing this for public repos, which would work, but doesn't solve the issue of private repos.
jrochkind1 12y ago
It sounds like creating PR's is what you're doing, from other people's reports? Which is great. But Github tells me I'm about to grant you permissions to make commits directly to all my repos. Can you ask for fewer permissions from github? I haven't tried it myself yet, because it gave me a bad feeling giving you such permissions. (the permissions sound like they give full git commit access, which would of course include rewriting history. To a random third party? That seems like a terrible idea. If someone wanted to release such a service and use it to inject security vulnerabilities in everyone's (or just some specific targets) code....)
- mwarkentin 12y ago
  Yeah, in order to create a pull request, I first need to commit to a branch on the repo. I suppose for public repos, I could fork and send the PR from there, but I don't know if there's a way that makes sense to do that for private repos. I'll take another look at Github's permissions, but I don't think there's any other way around it right now.
  - jrochkind1 12y ago
    Ah, I see. There must be SOME way to do it -- there are other tools that make PR's without getting commit rights. (Although I can't think of them now, ha, I'm pretty positive I've seen it.) But it might be cumbersome, or as you say, not work well with private repos. You should contact Github support and show them your site and explain what you're doing and ask advice. Github support is pretty good, the people responding seem to generally know what they're talking about. They'll probably think it's a cool service, as well as agree that full commit rights are inappropriate. If there's no good way to do it now, perhaps your query will spark some interest at Github in making better ways to do it. I think this service is really neat, but I'm really uncomfortable with giving full write access to all my repos to a random third party. It would be slightly less bad (but still bad), perhaps, if I could grant you permission on one repo at a time, and then I'd go in and revoke it after the PR.
    - mwarkentin 12y ago
      If you can find any other tools which create, not just comment on pull requests, please send them my way.. maybe there is a better way for me to do this. I just took another look, and I am asking for too many permissions - I should really be restricting it to these: https://s3.amazonaws.com/snaps.michaelwarkentin.com/Authorize_shrinkray.io_staging_2014-12-23_11-40-02.png https://s3.amazonaws.com/snaps.michaelwarkentin.com/Authoriz... Although that is probably still too much to make you comfortable.
      - mwarkentin 12y ago
        It looks like I'm already restricting scope as far as possible (for now, at least): https://developer.github.com/v3/oauth/#scopes https://developer.github.com/v3/oauth/#scopes I request user:email and repo scopes.
      - jrochkind1 12y ago
        I am _sure_ I've seen a pull request from a bot I had never given permissions to before, but I can't recall what it was. But it may have actually been a screen-scraping bot -- when I google around, ironically the first thing I find is something that was doing _exactly_ what you are, and ended up getting banned by Github for being annoying. (Don't worry, by being opt-in, you won't be). http://www.wired.com/2012/12/github-bots/ http://www.wired.com/2012/12/github-bots/ I really encourage you to contact Github with your use case, I think they'll like what you're doing, and maybe it will implant the seed to make it possible to do easily without write permissions that ought not to be neccesary. Services like this are good for github's business, as well as probably being personally gratifying to githubbers, and they've built out their API's in response to real use cases.

frabcus 12y ago

You could always fork repos to your own robot account, and then do the pull request from there.

JangoSteve 12y ago
If your repo is private, then they'd either need a really large paid account and pay for the private fork they create of your repo, or they'd have to fork your repo as a public repo. Obviously neither is really an option. EDIT: Unless you mean just doing this for public repos, which would work, but doesn't solve the issue of private repos.

jrochkind1 12y ago

It sounds like creating PR's is what you're doing, from other people's reports? Which is great. But Github tells me I'm about to grant you permissions to make commits directly to all my repos. Can you ask for fewer permissions from github? I haven't tried it myself yet, because it gave me a bad feeling giving you such permissions. (the permissions sound like they give full git commit access, which would of course include rewriting history. To a random third party? That seems like a terrible idea. If someone wanted to release such a service and use it to inject security vulnerabilities in everyone's (or just some specific targets) code....)

mwarkentin 12y ago
Yeah, in order to create a pull request, I first need to commit to a branch on the repo. I suppose for public repos, I could fork and send the PR from there, but I don't know if there's a way that makes sense to do that for private repos. I'll take another look at Github's permissions, but I don't think there's any other way around it right now.
- jrochkind1 12y ago
  Ah, I see. There must be SOME way to do it -- there are other tools that make PR's without getting commit rights. (Although I can't think of them now, ha, I'm pretty positive I've seen it.) But it might be cumbersome, or as you say, not work well with private repos. You should contact Github support and show them your site and explain what you're doing and ask advice. Github support is pretty good, the people responding seem to generally know what they're talking about. They'll probably think it's a cool service, as well as agree that full commit rights are inappropriate. If there's no good way to do it now, perhaps your query will spark some interest at Github in making better ways to do it. I think this service is really neat, but I'm really uncomfortable with giving full write access to all my repos to a random third party. It would be slightly less bad (but still bad), perhaps, if I could grant you permission on one repo at a time, and then I'd go in and revoke it after the PR.
  - mwarkentin 12y ago
    If you can find any other tools which create, not just comment on pull requests, please send them my way.. maybe there is a better way for me to do this. I just took another look, and I am asking for too many permissions - I should really be restricting it to these: https://s3.amazonaws.com/snaps.michaelwarkentin.com/Authorize_shrinkray.io_staging_2014-12-23_11-40-02.png https://s3.amazonaws.com/snaps.michaelwarkentin.com/Authoriz... Although that is probably still too much to make you comfortable.
    - mwarkentin 12y ago
      It looks like I'm already restricting scope as far as possible (for now, at least): https://developer.github.com/v3/oauth/#scopes https://developer.github.com/v3/oauth/#scopes I request user:email and repo scopes.
    - jrochkind1 12y ago
      I am _sure_ I've seen a pull request from a bot I had never given permissions to before, but I can't recall what it was. But it may have actually been a screen-scraping bot -- when I google around, ironically the first thing I find is something that was doing _exactly_ what you are, and ended up getting banned by Github for being annoying. (Don't worry, by being opt-in, you won't be). http://www.wired.com/2012/12/github-bots/ http://www.wired.com/2012/12/github-bots/ I really encourage you to contact Github with your use case, I think they'll like what you're doing, and maybe it will implant the seed to make it possible to do easily without write permissions that ought not to be neccesary. Services like this are good for github's business, as well as probably being personally gratifying to githubbers, and they've built out their API's in response to real use cases.