Description
What article on docs.github.com is affected?
What part(s) of the article would you like to see updated?
In "Creating encrypted secrets for a repository," it says:
To create secrets for a user account repository, you must be the repository owner. To create secrets for an organization repository, you must have
adminaccess.
However, according to the API docs:
Authenticated users must have collaborator access to a repository to create, update, or read secrets.
So, only admins can use the web interface to access secrets, but users with write access or above can use the API (directly, or indirectly, e.g., via Terraform). This is in fact the actual behaviour.
Additional information
This feels like a security issue, since updating secrets via the API involves not much of a record or oversight AFAICT (as opposed to, say, creating a workflow that dumps all secrets, which could leave traces that a bad actor cannot easily remove). I did report it as one, and the response is that this is intentional to allow users with write access to create and maintain workflows (which is understandable and fine by me). However, the current behaviour can be a bit surprising and the docs a bit time-wasting (I would write Terraform code that my org's admin would then apply, when I could have just applied them myself).