Repository navigation
Elevated GitHub Admin permissions on a separated Bot #72
Description
In order to have a bot that can automate adding/removing org users, and perhaps other things, elevated permissions from the TSC are necessary for a separate bot user to enable these things.
Some things to consider:
- How to host this bot's github keys on build machines
- Who has deployment access to these keys
- Who can push the github repo to make it live on the deployment
Note: I call this a bot since it will probably need a separate GitHub user, it may just be a simple script.
Activity
jbergstroem commentedon Sep 15, 2016
..and now we also have this: https://developer.github.com/early-access/integrations/
phillipj commentedon Sep 19, 2016
Just got a protip from GH staff about organisation being able to create private org wide integrations, which seems like a good fit for the bot.. That would make it a lot easier for us to enable bot integration on different repos, rather than adding the webhook manually in repos like we're doing today.
https://platform.github.community/t/allow-integration-for-organisations/467/2
williamkapke commentedon Sep 24, 2016
I just re-reviewed the Personal Access Token access options. If we set up the bot's token correctly, there isn't much it can do that is majorly destructive.
Q & A
Q: Can it delete the org!?
A: No. The GitHub API doesn't even have this option.
Q: Can it delete the Node repo!? (or any repo)
A: Don't give it
delete_reposcope... and then No, it can't.Q: Can it delete teams?
A: From the API docs...
Permission Options
Here is a screenshot of the available permissions that can be assigned to a token:
Can someone log in to the Bot account and check what this screen looks like? Post it here so we can discuss? ... and also uncheck many of them ASAP if they're obvious ones.
It seems scary to see it say "Full control of orgs and teams" but I can't seem to find anything scary that is available via the API. Please double check and prove me wrong so we make sure we get this right ;)
So, for now, I believe this fear of "Elevated Permission" is a moot point... but I miss things & look forward to finding out what. 😅
phillipj commentedon Sep 24, 2016
It only has one checkbox checked: repo -> public_repo.
williamkapke commentedon Sep 24, 2016
Excellent!
The TSC already approved allowing the bot to have the permission as long as it is contained to just adding/removing people- which it appears it is. So, can you add the "admin:org" checkbox?
phillipj commentedon Sep 24, 2016
Done :)
On Saturday, 24 September 2016, William Kapke notifications@github.com
wrote:
Trott commentedon Mar 7, 2025
Seems like this is resolved and/or something that isn't likely to happen. I'm going to Be Bold™ and close it but feel free to reopen if I'm just being rash.