These are the permissions in the app's manifest. GitHub shows them on the install screen; nothing outside this list is requested.
| Permission | Scope | Access | Used for |
|---|---|---|---|
organization_administration |
Organization | read | Last month's billed Actions spend from the billing usage report |
members |
Organization | write | Members, outside collaborators and invitations; cancelling an invitation |
organization_copilot_seat_management |
Organization | write | Copilot seats and their activity; reclaiming a seat |
organization_plan |
Organization | read | The plan and its filled seat count |
metadata |
Repository | read | Listing repositories (every GitHub App has this) |
actions |
Repository | write | Workflow runs and job timings; disabling a dormant schedule |
contents |
Repository | write | Reading workflow files; committing a fix to a new branch |
pull_requests |
Repository | write | Opening a fix pull request |
workflows |
Repository | write | GitHub requires it to change any file under .github/workflows |
plan |
Account | read | A personal account's own billing, read with its owner's sign-in, never another person's |
emails |
Account | read | The verified email address of the person signing in, for sign-in and the reports they ask for |
Sign-in
Signing in to opsen uses a separate GitHub OAuth flow with these scopes:
| Scope | Why |
|---|---|
read:user |
Your login and name |
user:email |
Your primary verified email, for the report-ready email |
read:org |
Whether you are an owner of an organisation that installed opsen |
An installation can read an organisation, but it cannot say who is asking. Owner status is checked with your own token on every sign-in, when you press Re-check access, and again at most an hour after the last check. When someone leaves the organisation, GitHub's member_removed event removes their access at once, and their API keys with it. If GitHub cannot answer a check, access stays as it was until it can; only an answer that you are not an owner removes it.
A personal account belongs to the GitHub account id that installed opsen, not to its login, so a login that is renamed and taken by someone else does not carry access with it.
Events
opsen subscribes to installation, installation_repositories, organization, member and repository events, to keep the installation record current, and to pull_request so that, when an owner turns on notes on merged pull requests, it can price a pull request's CI when it merges. Nothing is done with a pull request event while that setting is off. It does not subscribe to push or workflow events.