Update Deno Deploy github app description? about deploy_examples HOT 6 CLOSED

Act on your behalf is not an all-encompassing permission. It just means that if we asked for any permissions which allowed us to act as your user account (which we do not, we only request readonly email access), we would be able to act as your account. This is the minimal set of permissions you can request from GitHub as a GitHub App.

More info: https://github.community/t/why-does-this-forum-need-permission-to-act-on-my-behalf/120453

A description has now been added to the GitHub App.

TLDR:

• We can only read-only access your email (read-only), and status checks and source code for repos your explicitly add the app to.

from deploy_examples.

Thanks for the pointer to that thread, though it kind of raised more questions than it answered.

So you are saying even though the wording is Act on your behalf, trust the app will only request

• read-only email address access (presumably to send email alerts?)
• status checks (what is a status check? like, reading the state of PRs?)
• the ability to ask to read a repositories source code

from deploy_examples.

I guess if you only request read-only email access, its a bit confusing why it should be a github app at all. Especially after skimming https://docs.github.com/en/developers/apps/about-apps where there is an explicit callout:

Don't use a GitHub App if you just need a "Login with GitHub" service. But a GitHub App can use a user identification flow to log users in and do other things.

Though its weird the flowchart diagram later on the page would suggest "make a github app"

from deploy_examples.

We also allow you to install the app on repositories. That is why it is a GitHub App. The 'can act on your behalf' wording is rather dubious - not sure what GitHub means with that. We specifically only request read only email access during signin. It is not possible for us to do things like post comments, or push to repos as your user account.

from deploy_examples.

Thank you for the clarification. Sounds like poor wording on GitHub's part.

from deploy_examples.

I'll close this as unactionable then.

from deploy_examples.