Correct collaborator permission levels for personal-account repositories - #45538
Open
aaronariasperez wants to merge 1 commit into
Open
Correct collaborator permission levels for personal-account repositories#45538aaronariasperez wants to merge 1 commit into
aaronariasperez wants to merge 1 commit into
Conversation
## Why
Three statements in this article do not match the behaviour of the REST API. I verified each against the live API (`X-GitHub-Api-Version: 2026-03-10`).
`PUT /repos/{owner}/{repo}/collaborators/{username}` on a **private repository owned by a personal account**:
| requested | HTTP | recorded permission |
|---|---|---|
| `pull` | 201 | `read` |
| `triage` | 422 | Validation Failed |
| `push` | 201 | `write` |
| `maintain` | 422 | Validation Failed |
| `admin` | 201 | `admin` |
Control run, same script and token, against a **private repository owned by an organization** — all five values accepted and recorded as requested.
So personal-account repositories do support read, write and admin for collaborators. Only `triage` and `maintain` are organization-only, and the API rejects those explicitly with a `422` rather than silently substituting another level.
Enforcement was confirmed independently: a collaborator granted `pull` on a private personal-account repository has `git push` rejected by the server and cannot access repository settings, while a collaborator granted `admin` can.
## Scope of this change
- Verified on GitHub.com only (`fpt` / `ghec`). This article is also versioned for `ghes`, which I could not test. Happy to wrap the change in `{% ifversion fpt or ghec %}` if a maintainer confirms GHES behaves differently.
- I deliberately did **not** touch the "Owner access" table. If admin can be granted to a collaborator, some entries there may also need revisiting, but I have not tested which, so I left it alone rather than guess.
Refs github#45537
Contributor
How to review these changes 👓Thank you for your contribution. To review these changes, choose one of the following options: A Hubber will need to deploy your changes internally to review. Table of review linksNote: Please update the URL for your staging server or codespace. The table shows the files in the
Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server 🤖 This comment is automatically generated. |
github-actions
Bot
added
the
triage
Contributor
|
Please see my comment here 🙇 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Three statements in this article do not match the behaviour of the REST API. I verified each against the live API (
X-GitHub-Api-Version: 2026-03-10).PUT /repos/{owner}/{repo}/collaborators/{username}on a private repository owned by a personal account:pullreadtriagepushwritemaintainadminadminControl run, same script and token, against a private repository owned by an organization — all five values accepted and recorded as requested.
So personal-account repositories do support read, write and admin for collaborators. Only
triageandmaintainare organization-only, and the API rejects those explicitly with a422rather than silently substituting another level.Enforcement was confirmed independently: a collaborator granted
pullon a private personal-account repository hasgit pushrejected by the server and cannot access repository settings, while a collaborator grantedadmincan.Scope of this change
fpt/ghec). This article is also versioned forghes, which I could not test. Happy to wrap the change in{% ifversion fpt or ghec %}if a maintainer confirms GHES behaves differently.Refs #45537
Why:
Closes:
What's being changed (if available, include any code snippets, screenshots, or gifs):
Check off the following: