← All permissions
Repository permission·pull_requests:write
Pull requests: Write
Tier 2 · Medium
Why Tier 2
Opens, reviews, approves and merges pull requests. An approval can satisfy a review rule when the approver counts as a reviewer.
- Target
- Repository
- Plane
- DataCode: Repository contents, branches, tags, pull requests, checks and commit signing keys.
- Granted by
- Fine-grained PAT, GitHub App, GITHUB_TOKEN
- Available on
- Every setup
- In a workflow
permissions: pull-requests: write
What it unlocks
43 REST endpoints need this permission. A few of them:
- POST /repos/{owner}/{repo}/pulls
- PATCH /repos/{owner}/{repo}/pulls/comments/{comment_id}
- DELETE /repos/{owner}/{repo}/pulls/comments/{comment_id}
- POST /repos/{owner}/{repo}/pulls/comments/{comment_id}/reactions
Roles that include it
- T0OwnerThe organization and every repository in it
- T0All-repository adminEvery repository in the organization
- T1WriteOne repository
- T1MaintainOne repository
- T1AdminOne repository
- T1Collaborator on a personal repositoryOne repository owned by a personal account
- T1All-repository writeEvery repository in the organization
- T1All-repository maintainEvery repository in the organization
- T2TriageOne repository
- T2All-repository triageEvery repository in the organization
- T3ReadOne repository(in part: Proposes changes; nothing lands without someone with write access.)
- T3All-repository readEvery repository in the organization(in part: Proposes changes; nothing lands without someone with write access.)
Classic scopes that reach it
No classic scope reaches it. Only fine-grained PATs, Apps or GITHUB_TOKEN can grant it.
Attack paths
Techniques it enables
- Approve your own PR from a second account Submit malicious code
- Have a workflow approve the PR Submit malicious code
- Push more commits after approval Submit malicious code
- Approve someone else's PR, then push to it Submit malicious code
- Use a trusted colleague's account Submit malicious code
- Trick or outlast the reviewer Submit malicious code
Fixed or limited by
- Enforce MFA for every member (prefer hardware/FIDO2 keys over SMS or app codes)
- Run a quarterly access review of owners, repo admins, team membership and outside collaborators
- Branch protection on default/release branches: required reviews + required status checks
- CODEOWNERS in place, required on sensitive paths
- Rulesets applied: push restriction, tag protection, sensitive file-path protection
- Require signed commits on the default branch of sensitive repos
- Set the default GITHUB_TOKEN permission to read-only at the org level