Clarification about the scopes required for the Github plugin's access to Github organization

[mig5]

Clarification about the scopes required for the Github plugin's access to Github organization

[mickmister]

Thanks for submitting this issue @mig5 👍

Unfortunately, GitHub OAuth scopes do not have much support for read-only access https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps. In general we request the following scopes:

• public_repo
  • Limits access to public repositories. That includes read/write access to code, commit statuses, repository projects, collaborators, and deployment statuses for public repositories and organizations. Also required for starring public repositories.
• repo - In the case that the MM admin wants to connect to private repositories, we optionally include this scope
  • Grants full access to public and private repositories including read and write access to code, commit statuses, repository invitations, collaborators, deployment statuses, and repository webhooks. Note: In addition to repository related resources, the repo scope also grants access to manage organization-owned resources including projects, invitations, team memberships and webhooks. This scope also grants the ability to manage projects owned by users.
• notifications
  • read access to a user's notifications
  • mark as read access to threads
  • watch and unwatch access to a repository, and
  • read, write, and delete access to thread subscriptions.
• admin:org_hook
  • Grants read, write, ping, and delete access to organization hooks. Note: OAuth tokens will only be able to perform these actions on organization hooks which were created by the OAuth App. Personal access tokens will only be able to perform these actions on organization hooks created by a user.

---

(It's not clear what 'write' access to 'Settings' could entail, from a security perspective - could the plugin, for example, be abused to modify branch protection settings for a repository?)

I'm not sure what this entails either. I know the only write actions the plugin does is creating issues/comments/reactions, and creating webhooks. Maybe the webhook permission is what is signaling the Settings part.

Is there no way to customize the scopes to some sort of subset?

At the moment, you cannot do this with the plugin, but we can look into supporting this.

cc @hanzei

[hanzei]

Closing as the question has been answered