fix: allow GitHub App access to public repositories without installation

This commit is contained in:
Thomas Durieux
2026-09-13 08:42:55 +00:00
parent 22096a8346
commit 8efb9bd506
5 changed files with 100 additions and 4 deletions
+9 -2
View File
@@ -95,8 +95,15 @@ form. Existing installations have direct account-specific configuration links.
GitHub may require organization administrator approval. Use **Refresh access
after approval** on the Connections page when approval is delayed.
App-connected accounts default to the App for new repository/PR access. The
explicit **Use existing OAuth access** choice handles repositories not yet
App-connected accounts default to the App for new repository/PR access.
Public repositories outside the selected installations use the App user grant,
so users can paste a public URL without installing the App on its owner account.
The connection records the repository ID and checks that it is still public on
each source access. If it becomes private, reconnect through an installation
with access. Existing installation bindings retain their installation checks.
This uses GitHub's documented [public resource access for App user tokens](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/choosing-permissions-for-a-github-app).
The explicit **Use existing OAuth access** choice handles repositories not yet
available through the App. An App error never silently selects OAuth. Gists
continue using OAuth. An App-only user entering a gist URL is prompted to connect
OAuth, with the current repository permission scope explained. The form draft