GitHub Announces Major App Improvements for Least Privilege
GitHub has rolled out a series of significant updates aimed at enhancing GitHub App management, implementing stricter least-privilege principles, and helping developers move away from classic personal access tokens.
Radwan AbdulhadiEditor and technology writer
New Fine-Grained Permissions for Repository Management
GitHub has released several improvements designed to help developers move away from classic personal access tokens (PATs), improve overall GitHub App management, and request fewer sensitive permissions. Among these updates are two new repository fine-grained permissions available to both fine-grained PATs and GitHub Apps: repository_creation:write and installation_repositories:write. The first permission allows the caller to create a repository in the account where it is granted, while the second allows adding or removing that repository from an organization installation.
Previously, an application or PAT required repository_administration:write in order to create a repository. However, that broad permission also granted other powerful administrative features such as deletion and transfer. This over-privilege risk often led administrators to reject apps or ban PATs. By introducing repository_creation:write, GitHub supports a least-privilege approach by granting only the capability to create repositories. The platform provides documentation for API usage regarding repository creation in organizations, from a template, for the current user, with a fork, and via GraphQL.
Streamlining Installation and Repository Control
The platform has also updated organization-level APIs to support the installation_repositories:write permission. The Add a repository to an installation organization-level API and its corresponding removal API now fully support GitHub Apps and fine-grained PATs, whereas they previously only supported the coarse-grained repo scope. These enhancements allow organizations to construct automation that controls which repositories are accessible to specific GitHub Apps without relying on an administrator's PAT with overly broad permissions.
Historically, all applications requesting organization-level access were strictly blocked from being installed on a repository by a repository administrator. GitHub has now relaxed this restriction if the application is already installed in the organization and approved by an organization owner. Repository administrators can edit an existing installation to add their repositories to an app without requiring additional owner approval, as long as it does not increase the app's overall organization-level access.
Security Governance and Offline Access Updates
To maintain strong governance, organizations wishing to prevent repository administrators from adding apps independently can consult the official documentation on Restricting GitHub App Installation to Organization Owners. Additional details on integrating apps can be found in the guide on Installing a GitHub App.
Furthermore, GitHub Apps now support the offline_access scope in a manner similar to OAuth apps. Although GitHub Apps use short-lived, rotating tokens by default, some developers previously disabled expiration and struggled to reenable it. The new offline_access scope helps app developers gradually migrate to expiring user access tokens by issuing a refresh token alongside the expiring access token during requests.
Expanded App Visibility and Credential Management UI
GitHub Apps can now utilize the Get an app API to fetch details about other private and internal applications, provided they share some ownership context. While public apps were already accessible to any other app, internal and private apps can now be queried within the same organization, enterprise boundaries, or through enterprise-to-organization access models. This change improves the ability of organizations and enterprises to automate auditing and administration workflows.
Finally, GitHub App credentials are now organized into a dedicated Credentials tab instead of appearing inline within general app configurations. This separation makes credentials much easier to locate and sets aside designated space for upcoming workload federation features. GitHub notes that these updates will roll out generally, with offline_access support included in GHES 3.23 and the remaining improvements arriving in GHES 3.24.
Sources
- GitHub ChangelogGitHub App improvements for least privilege and management
Continue chronologically
Related entity coverage
Related stories
Enterprise Installations for GitHub Apps Generally Available
GitHub announces that installing GitHub Apps on your enterprise is now generally available, allowing teams to replace classic PATs with expanded APIs.
GitHub Highlights Accessibility Statements on Repository Overview
GitHub now highlights ACCESSIBILITY.md files on repository overviews, making it easier for developers to discover and share accessibility project info.
GitHub Announces Major Security Improvements for SSH
GitHub is removing several outdated SSH algorithms, adding a post-quantum key exchange method, and requiring larger RSA SSH keys for improved security.
GitHub Stacked Pull Requests Reach General Availability
GitHub stacked pull requests are now generally available, introducing improvements for code reviews, automated merges, and branch management.
