GitHub App 最小权限与管理能力改进

We’re releasing several GitHub Apps improvements today that help developers move off of classic PATs, improve GitHub App management, and request fewer sensitive permissions. We’ve also made it easier for repository administrators to use apps that their administrators have approved and updated the GitHub App credential management UI in advance of our planned workload federation features. Two new repository fine-grained permissions have been added, available to both fine-grained PATs and GitHub Apps. repository_creation:write : Allows the caller to create a repository in the account where it’s granted. installation_repositories: write : Allows the caller to add or remove that repository from an installation in the organization. You can now use the repository_creation:write permission to create repositories without needing the broader repository_administration:write permission. Previously, an app or PAT needed repository_administration:write to create a repository. That permission also grants other repository administration features like deletion and transfer. This could lead to administrators rejecting apps, banning PATs with this permission, or having to accept the over-privilege risk. The new permission supports a least-privilege approach by granting only the ability to create repositories. When the repository is created, the app or user that created it will be given access to it. An app using this permission still requires an organization administrator to install the app. See the API docs for repository creation in organizations , from a template , for the current user , with a fork , and via GraphQL . The Add a repository to an installation organization-level API and its corresponding removal API now support GitHub Apps and fine-grained PATs. Previously, these APIs only supported the coarse-grained repo scope. These APIs support a new repository-level fine-grained permission: installation_repositories:write . Having this permission on a repository allows the caller to add or remove that repository from any installation in the organization. If the caller is a user, they must also be an organization owner or an administrator on the repository in question. This allows organizations to build automation that controls which repositories are accessible to which GitHub Apps without relying on an administrator’s PAT with broad permissions. Historically, all apps that requested organization-level access were blocked from being installed on a repository by a repository administrator, no matter what. This restriction has been relaxed in the case where the app is already installed in the organization, meaning it’s been approved by an organization owner for that organization-level access. Repository administrators can now edit an existing installation to add their repositories to an app without requiring organization owner approval. The apps already have the organization-level access, so adding them to another repository in the organization doesn’t increase that access or give the repository administrator additional privileges.