fix(scopes): allow public_repo scope for public repository write tools - #3150
Open
CAOShurong wants to merge 1 commit into
Open
fix(scopes): allow public_repo scope for public repository write tools#3150CAOShurong wants to merge 1 commit into
CAOShurong wants to merge 1 commit into
Conversation
Several repository write tools declared the broad `repo` scope, which hid them from tokens limited to `public_repo` and forced public-only OAuth deployments to request private-repository access. Lower the required scope to public_repo for tools that only operate on repositories the token can already reach: - add_issue_comment - issue_write - create_branch - push_files - create_pull_request - fork_repository Because RequiredScopes are expanded through the scope hierarchy, a full repo token remains accepted for every tool. GitHub continues to enforce actual per-repository permissions at the API layer. Fixes github#3136
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #3136 by lowering the required OAuth scope from
repotopublic_repofor the six repository write tools the issue identifies as public-repo-safe:add_issue_commentissue_writecreate_branchpush_filescreate_pull_requestfork_repositoryAn OAuth deployment that only needs to contribute to public repositories can now request least-privilege
public_repoinstead of the broadreposcope (which also grants private-repository access).Why this is safe
NewToolderivesAcceptedScopesthrough the existing hierarchy (ExpandScopes:repois a parent ofpublic_repo), so a fullrepotoken still satisfies every one of these tools — no regression for existing deployments.Testing
pkg/github/public_repo_scope_test.go:TestPublicRepoWriteToolsDeclareLeastPrivilegeScopesasserts each tool advertisesrequired: [public_repo]andaccepted: [public_repo, repo].TestPublicRepoWriteToolsVisibleToPublicRepoTokenasserts the PAT tool filter (CreateToolScopeFilter) shows every tool to apublic_repo-only token and keeps it visible for a fullrepotoken.go build ./...,go vet ./pkg/github/ ./pkg/scopes/, gofmt clean on changed files.go test ./pkg/github/ -count=1: no new failures vs a stash-baseline run on clean main (the 6 pre-existing environment-dependent failures reproduce identically on both).