cicadahq/cicada

github connection requires too many permissions

Closed this issue · 4 comments

barthuijgen commented

The permission screen to sign in with Cicada

cicada-permission

Can access basically everything on my account!

As comaprison, here is another service that needs access to code: Deno deploy

deno-deploy-permissions

And similar services like cloudflare pages, etc will allow you to select what repositories to give access to.

Thanks for the early waitlist invite, but I can not test Cicada with these permissions.

grant0417 commented

I don't think we actually need all of these permissions and is its a bug to request all of them at the start, will confirm tomorrow.

grant0417 commented

@mschrage thoughts on this?

mschrage commented

I think we can downscope permissions to read-only for repos. (We need to be able to list them prior to the user adding the Github app to their org/personal account)

grant0417 commented

Hey @barthuijgen, we did some work and reduced the needed permissions to just your user and orgs, no more repo access.

  • 👍2