GitHub Apps get fine-grained permissions for creating repositories and managing installation repositories, plus offline_access refresh tokens
Bots and agents that integrate with GitHub can ask for just the permission a task needs instead of full repository administration.
// Key points
- New repository_creation:write lets the caller create repositories without the broader repository_administration:write, and installation_repositories:write lets it add or remove repositories from any installation in the organization.
- The organization-level APIs for adding and removing installation repositories now support GitHub Apps and fine-grained PATs, which previously required the coarse repo scope.
- When an app is installed at the organization level, repository admins can add their repositories without owner approval; organization-level permissions, repository administration and repository creation still need it.
- GitHub Apps now support offline_access and receive a refresh token with the expiring access token, and credentials move to a dedicated Credentials tab ahead of workload federation credentials.
Builder's takeThe usual compromise when giving an agent a GitHub token is granting full administration for a single create-repository action. I’d audit the team’s automation PATs and move whatever I can to a GitHub App with fine-grained permissions, alongside the push protection and push attribution from the last two issues.