Yeah, understood that this could be an issue for people. I'd like to at least be able to split out granting access to public / private repos - although write to public could still be an issue..
What do you mean by creating PRs automatically instead?
What do you mean by creating PRs automatically instead?
But Github tells me I'm about to grant you permissions to make commits directly to all my repos.
Can you ask for fewer permissions from github?
I haven't tried it myself yet, because it gave me a bad feeling giving you such permissions. (the permissions sound like they give full git commit access, which would of course include rewriting history. To a random third party? That seems like a terrible idea. If someone wanted to release such a service and use it to inject security vulnerabilities in everyone's (or just some specific targets) code....)
I'll take another look at Github's permissions, but I don't think there's any other way around it right now.
There must be SOME way to do it -- there are other tools that make PR's without getting commit rights. (Although I can't think of them now, ha, I'm pretty positive I've seen it.) But it might be cumbersome, or as you say, not work well with private repos.
You should contact Github support and show them your site and explain what you're doing and ask advice. Github support is pretty good, the people responding seem to generally know what they're talking about. They'll probably think it's a cool service, as well as agree that full commit rights are inappropriate. If there's no good way to do it now, perhaps your query will spark some interest at Github in making better ways to do it.
I think this service is really neat, but I'm really uncomfortable with giving full write access to all my repos to a random third party.
It would be slightly less bad (but still bad), perhaps, if I could grant you permission on one repo at a time, and then I'd go in and revoke it after the PR.
I just took another look, and I am asking for too many permissions - I should really be restricting it to these: https://s3.amazonaws.com/snaps.michaelwarkentin.com/Authoriz...
Although that is probably still too much to make you comfortable.
I request user:email and repo scopes.
But it may have actually been a screen-scraping bot -- when I google around, ironically the first thing I find is something that was doing _exactly_ what you are, and ended up getting banned by Github for being annoying. (Don't worry, by being opt-in, you won't be).
http://www.wired.com/2012/12/github-bots/
I really encourage you to contact Github with your use case, I think they'll like what you're doing, and maybe it will implant the seed to make it possible to do easily without write permissions that ought not to be neccesary. Services like this are good for github's business, as well as probably being personally gratifying to githubbers, and they've built out their API's in response to real use cases.
EDIT: Unless you mean just doing this for public repos, which would work, but doesn't solve the issue of private repos.