When I need more granular access, this is how I set it up:

1) Create a new GitHub user: e.g. (circleci-builder@example.com) 2) Grant read-only access to specific repositories to the new user. 3) Configure CI to use that user.

GitHub recently added a repo:status OAuth scope for this use case. Unfortunately, I still don't see a scope for read-only access to repo code.

https://developer.github.com/apps/building-integrations/sett...