GitHub App improvements for least privilege and management
By Steven Van ·
Both GitHub Apps and fine-grained personal access tokens gain permissions for repository creation and installation access management.
Apps and fine-grained personal access tokens on GitHub can now create repositories and manage installation access with two new, narrower permissions. Repository administrators also have more flexibility to add repositories to apps their organization owners have already approved.
Create repositories with fewer permissions
The new repository_creation:write permission allows an app or token to create repositories in the account where it is granted. Previously, this required repository_administration:write, which also permits actions such as deletion and transfer.
The app or user that creates a repository receives access to it. An app using the new permission still requires an organization administrator to install it.
Manage which repositories an installation can access
The APIs for adding a repository to an organization installation and removing it now support GitHub Apps and fine-grained personal access tokens. Previously, they only supported the broader repo scope.
The new installation_repositories:write permission allows the caller to add or remove the repository from any installation in the organization. A user making the request must also be an organization owner or an administrator of that repository.
Extend access to approved apps
As the installation requirements explain, repository administrators can give an app access to repositories they administer if an organization owner has already installed it. This applies regardless of the app’s permissions, because the owner approved those permissions during installation.
Organization owners can restrict this ability. When that restriction is enabled, repository administrators must request installation from an owner. GitHub has also updated its app credential management interface ahead of planned workload federation features.
