5 ms·

Yeah, in order to create a pull request, I first need to commit to a branch on the repo. I suppose for public repos, I could fork and send the PR from there, bu

Yeah, in order to create a pull request, I first need to commit to a branch on the repo. I suppose for public repos, I could fork and send the PR from there, but I don't know if there's a way that makes sense to do that for private repos. I'll take another look at Github's permissions, but I don't think there's any other way around it right now.

jrochkind1 12y ago
Ah, I see. There must be SOME way to do it -- there are other tools that make PR's without getting commit rights. (Although I can't think of them now, ha, I'm pretty positive I've seen it.) But it might be cumbersome, or as you say, not work well with private repos. You should contact Github support and show them your site and explain what you're doing and ask advice. Github support is pretty good, the people responding seem to generally know what they're talking about. They'll probably think it's a cool service, as well as agree that full commit rights are inappropriate. If there's no good way to do it now, perhaps your query will spark some interest at Github in making better ways to do it. I think this service is really neat, but I'm really uncomfortable with giving full write access to all my repos to a random third party. It would be slightly less bad (but still bad), perhaps, if I could grant you permission on one repo at a time, and then I'd go in and revoke it after the PR.
- mwarkentin 12y ago
  If you can find any other tools which create, not just comment on pull requests, please send them my way.. maybe there is a better way for me to do this. I just took another look, and I am asking for too many permissions - I should really be restricting it to these: https://s3.amazonaws.com/snaps.michaelwarkentin.com/Authorize_shrinkray.io_staging_2014-12-23_11-40-02.png https://s3.amazonaws.com/snaps.michaelwarkentin.com/Authoriz... Although that is probably still too much to make you comfortable.
  - mwarkentin 12y ago
    It looks like I'm already restricting scope as far as possible (for now, at least): https://developer.github.com/v3/oauth/#scopes https://developer.github.com/v3/oauth/#scopes I request user:email and repo scopes.
  - jrochkind1 12y ago
    I am _sure_ I've seen a pull request from a bot I had never given permissions to before, but I can't recall what it was. But it may have actually been a screen-scraping bot -- when I google around, ironically the first thing I find is something that was doing _exactly_ what you are, and ended up getting banned by Github for being annoying. (Don't worry, by being opt-in, you won't be). http://www.wired.com/2012/12/github-bots/ http://www.wired.com/2012/12/github-bots/ I really encourage you to contact Github with your use case, I think they'll like what you're doing, and maybe it will implant the seed to make it possible to do easily without write permissions that ought not to be neccesary. Services like this are good for github's business, as well as probably being personally gratifying to githubbers, and they've built out their API's in response to real use cases.

jrochkind1 12y ago

Ah, I see. There must be SOME way to do it -- there are other tools that make PR's without getting commit rights. (Although I can't think of them now, ha, I'm pretty positive I've seen it.) But it might be cumbersome, or as you say, not work well with private repos. You should contact Github support and show them your site and explain what you're doing and ask advice. Github support is pretty good, the people responding seem to generally know what they're talking about. They'll probably think it's a cool service, as well as agree that full commit rights are inappropriate. If there's no good way to do it now, perhaps your query will spark some interest at Github in making better ways to do it. I think this service is really neat, but I'm really uncomfortable with giving full write access to all my repos to a random third party. It would be slightly less bad (but still bad), perhaps, if I could grant you permission on one repo at a time, and then I'd go in and revoke it after the PR.

mwarkentin 12y ago
If you can find any other tools which create, not just comment on pull requests, please send them my way.. maybe there is a better way for me to do this. I just took another look, and I am asking for too many permissions - I should really be restricting it to these: https://s3.amazonaws.com/snaps.michaelwarkentin.com/Authorize_shrinkray.io_staging_2014-12-23_11-40-02.png https://s3.amazonaws.com/snaps.michaelwarkentin.com/Authoriz... Although that is probably still too much to make you comfortable.
- mwarkentin 12y ago
  It looks like I'm already restricting scope as far as possible (for now, at least): https://developer.github.com/v3/oauth/#scopes https://developer.github.com/v3/oauth/#scopes I request user:email and repo scopes.
- jrochkind1 12y ago
  I am _sure_ I've seen a pull request from a bot I had never given permissions to before, but I can't recall what it was. But it may have actually been a screen-scraping bot -- when I google around, ironically the first thing I find is something that was doing _exactly_ what you are, and ended up getting banned by Github for being annoying. (Don't worry, by being opt-in, you won't be). http://www.wired.com/2012/12/github-bots/ http://www.wired.com/2012/12/github-bots/ I really encourage you to contact Github with your use case, I think they'll like what you're doing, and maybe it will implant the seed to make it possible to do easily without write permissions that ought not to be neccesary. Services like this are good for github's business, as well as probably being personally gratifying to githubbers, and they've built out their API's in response to real use cases.