News for hackers. Stuff that matters.

A comment on CircleCI trusts 8 analytics companies with your source code and API tokens. Parent comment

Re:CircleCI trusts 8 analytics companies with your source co... by bsimpson on Tuesday October 10, 2017 @04:52PM (#15445227)
Is there any way to limit what access CircleCI has to my GitHub account/orgs? GitHub says you have "Full control of private repositories," but it seems like all you need is read access + a push webhook.
[ Parent | on HN ]
Re:CircleCI trusts 8 analytics companies with your source co... by kevinburke on Tuesday October 10, 2017 @07:10PM (#15446050)
IIRC Circle needs to tell Github whether the build succeeded or failed.

It would be nice if Github offered more granular permissions.

[ Parent | on HN ]
Re:CircleCI trusts 8 analytics companies with your source co... by lancefisher on Tuesday October 10, 2017 @08:00PM (#15446250)
When I need more granular access, this is how I set it up:

1) Create a new GitHub user: e.g. ([email protected]) 2) Grant read-only access to specific repositories to the new user. 3) Configure CI to use that user.

[ Parent | on HN ]
Re:CircleCI trusts 8 analytics companies with your source co... by daxelrod on Tuesday October 10, 2017 @07:54PM (#15446225)
GitHub recently added a repo:status OAuth scope for this use case. Unfortunately, I still don't see a scope for read-only access to repo code.

https://developer.github.com/apps/building-integrations/sett...

[ Parent | on HN ]