What you give the site access to is something like ‘Full-repository access’, the permissions aren’t granular enough to specify starring.