ghtier
← All roles
Organization role·GitHub Apps owned by the organization

App manager

Tier 1 · HighManagement

Why Tier 1

Managing an App registration is not a permission on the reference. It decides what an organization-owned App asks for and where its webhooks go, which reaches every repository that App is installed on.

Creates, edits and deletes GitHub App registrations owned by the organization.

Available on: Every setup. Source

Permissions it includes (4)

TierPermissionFrom
T2Repository creation: Writerepository
  • Create repositories
documented
T3Issues: Writerepository

In part, counts as T3 (the full permission is T2): Moderation on repositories they can already write to.

  • Hide comments on writable commits, pull requests, and issues
inferred
T3Members: Readorganization
  • See all organization members and teams
documented
T3Members: Writeorganization

In part, counts as T3 (the full permission is T0): Creates a team. Giving it repository access needs a repository admin.

  • Create teams
inferred

Attack paths

No attack technique, escalation or incident on ghtier goes through this yet.

Abilities with no matching permission

These do not affect the tier.

  • @mention any visible team (Notifications only.)
  • Can be made a team maintainer (Eligibility, not a grant. See the Team maintainer role.)

GitHub Docs for this role