← All permissions
Repository permission·installation_repositories:write
GitHub App installation repository access: Write
Tier 1 · High
Why Tier 1
Adds repositories to a GitHub App installation the user can manage, giving the App its permissions on them.
- Target
- Repository
- Plane
- ManagementApps: Which repositories and organizations a GitHub App is installed on.
- Granted by
- Fine-grained PAT, GitHub App
- Available on
- Every setup
What it unlocks
2 REST endpoints need this permission. A few of them:
- PUT /user/installations/{installation_id}/repositories/{repository_id}
- DELETE /user/installations/{installation_id}/repositories/{repository_id}
Roles that include it
- T0OwnerThe organization and every repository in it
Classic scopes that reach it
No classic scope reaches it. Only fine-grained PATs, Apps or GITHUB_TOKEN can grant it.
Attack paths
Techniques it enables
- Add a guest collaborator or new app Keep access
Fixed or limited by
- Restrict public repo creation, visibility changes, repo deletion, private forks and outside collaborator invites to owners
- Run a quarterly access review of owners, repo admins, team membership and outside collaborators
- Review every currently installed GitHub App / OAuth App and its granted scope
- Keep OAuth app access restrictions on and require security/IT approval for new apps
GitHub Docs: Repository permissions for "GitHub App installation repository access"