GitHub integration permissions

[Michael Juarez]

Greetings,

We are looking at connecting the GitHub integration with Compass. We noticed that it wants the following permissions:

* Read access to actions, metadata, and organization events
* Read and write access to code, deployments, organization hooks, pull requests, and repository hooks.

Our SecEng team is looking for a better breakdown of what the possible write actions could be so they could correlate within audit logs.

[Dave Parrish _Atlassian_]

Hi @Michael Juarez 👋  It's Dave from the Compass product team. The GitHub integration needs write permission in order to create organization webhooks. This is the only write operation that the integration currently performs.

Webhooks are used for listening to several types of events-

• Push events - for handling changes to compass.yml metadata
• Pull request events - for calculating PR-related metrics
• Deployment events - for handling deploy events

Hope this is helpful! Please let me know if you have any further questions.

[Dmitry Pashkevich]

Why create organization webhooks when you can do it on a per-repo level? The latter would not require org admin permissions, which sounds scary and also comes with internal gatekeeping within the organization.