Once you have your report card, don't forget to revoke access. https://github.com/settings/applications
Good point. I can see a lot of people are worried this is getting write access. Thanks for providing a link and a reminder.
GitHub Report Card
21–30 of 71 posts
Re: GitHub Report Card
#22This application does, for some reason, require write access to all of mine and my organisation's repos. Just no.
We understand your reticence (Reflect employee here). Two things to note:
1. GitHub does not grant read-only access to repos. Any time you authorize a third-party app to access your repos, you are granting write access. We will never write to your repos, and our report card isn't doing anything out of the ordinary (i.e. it's not doing anything that TravisCI, Auth0, and a lot of other GitHub third-party apps don't do). 2. Your report card is accessible only by you and is not publicly viewable.
Re: GitHub Report Card
#23Please include a checkbox to exclude private repos. I have a lot of private work that I just can't let anyone see. Thank you!
Important note: these reports are accessible only by you, the user. They are not publicly available.
"Any third-party access" is often an NDA-violating action.
Re: GitHub Report Card
#24This sounds like an awful idea, who would want to grant write access to their private repos? Quick way to get fired IMO.
Re: GitHub Report Card
#25Please include a checkbox to exclude private repos. I have a lot of private work that I just can't let anyone see. Thank you!
Important note: these reports are accessible only by you, the user. They are not publicly available.
> these reports are accessible only by you
And by you, githubreportcard, and by all of your devs, etc, etc. I'm no lawyer, but I have a feeling this is what some of those NDAs were talking about.
Re: GitHub Report Card
#26I'm a Technical Product Manager at GitHub. I just took a look at this (pretty cool, maybe we should have deeper user metrics...). I saw a couple of comments about the 'write access' so I just figured I'd chime in and point out that it's a required scope to get all of the private contrib info out of the API. I definitely encourage people to be mindful of what access they grant, but for what it's worth I did it :)
> it's a required scope to get all of the private contrib info out of the API Is there a technical reason why that's so, or is it just an artifact of the way GitHub's OAuth scheme is set up? I can't think offhand of a reason why it should be the former, but my experience with GitHub private repos is somewhat seldom, so it's quite probable it is necessary for a reason of which I'm unaware.
I wonder too, especially considering it's possible to have collaborators with read-only access to private repos.
Re: GitHub Report Card
#27Earlier quoted context omitted.
Important note: these reports are accessible only by you, the user. They are not publicly available.
But I still have to trust you with access to my private repos - read-write access, yet. I'm sure you're an entirely upstanding human being who would never abuse such access, but I don't know you from Adam's off ox, too.
Unfortunately, GitHub does not provide read-only access to repos, be they public or private: https://developer.github.com/v3/oauth/#scopes.
If you've used Apiary, TravisCI, or a plethora of other third-party GitHub apps that access repos, then you have granted read/write access. We would love to see a read-only option but were bound by this limitation.
Re: GitHub Report Card
#28Open Source Report Card (OSRC) used to be a similar application that I used quite a bit with my friends. Unfortunately it seems to have broken with changes to the Github API.
Re: GitHub Report Card
#29Earlier quoted context omitted.
Important note: these reports are accessible only by you, the user. They are not publicly available.
> these reports are accessible only by you And by you, githubreportcard, and by all of your devs, etc, etc. I'm no lawyer, but I have a feeling this is what some of those NDAs were talking about.
Sure, but GitHub and all their devs have access to your private repos too. If that doesn't violate the NDA I'm not sure why GHRC would violate it either unless they've been grated special exception.
Re: GitHub Report Card
#30I'm a Technical Product Manager at GitHub. I just took a look at this (pretty cool, maybe we should have deeper user metrics...). I saw a couple of comments about the 'write access' so I just figured I'd chime in and point out that it's a required scope to get all of the private contrib info out of the API. I definitely encourage people to be mindful of what access they grant, but for what it's worth I did it :)
> it's a required scope to get all of the private contrib info out of the API Is there a technical reason why that's so, or is it just an artifact of the way GitHub's OAuth scheme is set up? I can't think offhand of a reason why it should be the former, but my experience with GitHub private repos is somewhat seldom, so it's quite probable it is necessary for a reason of which I'm unaware.
The new Integrations api they announced at their conference should allow way more granular control. Still in beta though AFAIK.