[Feedback] Custom Organization Roles #75655
Replies: 13 comments 16 replies
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
-
|
Hi @hpsin I see Github has a huge gap in |
Beta Was this translation helpful? Give feedback.
-
|
Hey @pragmaticivan , that's not the main goal, but it's something we can include in our guidance to teams. Do you have particular settings that you want to allow For the example above, I could imagine a "View SAML/SCIM settings" being useful for a troubleshooting team wanting to see and diagnose SCIM sync issues - but in many cases I'd then want that team to also be able to fix the problem, with the management permission. |
Beta Was this translation helpful? Give feedback.
-
|
But in general, the gap happens under the Repository settings most of the time, and less in the org, so maybe I'm inflating by posting about both in this thread, sorry about that :D |
Beta Was this translation helpful? Give feedback.
This comment has been minimized.
This comment has been minimized.
-
|
Hi all, I'm a Cloud Security engineer and spend a lot of time auditing company's github accounts (org settings, repo settings, github actions...). |
Beta Was this translation helpful? Give feedback.
-
|
It would be useful for us to have permissions that
Reason: Currently we do not allow creating / managing these settings for the whole enterprise. But for the dev teams to stay flexible and still make sure that naming conventions and other organizational topics are met, the only option currently is to give a subset of our employees Organization Owner permissions. And that is much more than is needed to create new Repos, Assign Runner Groups and Organizational Secrets / Variables to these new repos. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks! Runners group management is currently under development, and secrets management is a recognized need. For repo creation, you don't have to be an org admin to create a repo: https://docs.github.com/en/organizations/managing-organization-settings/restricting-repository-creation-in-your-organization Are you looking to grant that permission to only a subset of the users in your organization? |
Beta Was this translation helpful? Give feedback.
This comment has been minimized.
This comment has been minimized.
-
|
@hpsin Sounds all good, thanks for the update about the Runners group management and secrets management. I am really looking forward to it :-) Regarding your quesion: Indeed, that is exactly what we can not do at the moment without granting them Organisational permissions. For us it is not just about "that a repo exists". When a project starts, a Code repo is one of many pieces in our organization that have to work together. Projects are created, Plans, stuff in the ERP system, Documentations... and Code repositories. We have to tie these pieces together as good as we can (partly through naming conventions that needs to be obeyed) and make sure that developers have repos that behave in the same or similar way, so they can just code and not need to take care of DevOps stuff too much. And we found out that it works reliable when a small subset of your employees is responsible for certain tasks. Leads of our Dev Teams are allowed to create the repos and they do it according to our standards / rules. They know how to create them, what settings we want, which secrets / actions are needed for certain repos etc. But currently they need Organizational Admin permissions to do just that and these are a lot of permissions that are not needed to do this job. Following the pricinple of least permissions ist not possible for us at the moment and this would be a huge improvement. |
Beta Was this translation helpful? Give feedback.
-
|
FYI, runner management permissions shipped! |
Beta Was this translation helpful? Give feedback.
-
|
We would benefit from permissions that allowed us to create a role for someone to invite/remove members of the org. Currently we can only do this will full owner access, which is too much. |
Beta Was this translation helpful? Give feedback.
-
|
ACK, it's on the list, thank you! |
Beta Was this translation helpful? Give feedback.
-
|
@hpsin re: Invitation and membership permissions - Can we follow along in a public roadmap item? I'd like to know if it meets the expectations we have. |
Beta Was this translation helpful? Give feedback.
This comment has been minimized.
This comment has been minimized.
-
|
Ability to assign a team with permissions to manage Org Secrets would be beneficial if that is possible. |
Beta Was this translation helpful? Give feedback.
-
|
The org secrets permission was just shipped - check it out! |
Beta Was this translation helpful? Give feedback.
-
|
awesome |
Beta Was this translation helpful? Give feedback.
-
|
Currently we would see the need for those functionality in GHES:
|
Beta Was this translation helpful? Give feedback.
-
|
A few granular permissions for Organization roles that we'd find helpful:
Also, I second a previous comment, that overall Github should provide more read-only permissions. Those are generally useful for providing insight, without giving too much access. Also, related to permissions, It would be nice if we could completely disable these things org-wide:
|
Beta Was this translation helpful? Give feedback.
-
|
I would like to be able to delegate the following rights:
|
Beta Was this translation helpful? Give feedback.
-
|
View/edit org secrets and variables is now a permission! The runners one may or may not be granular enough for your desires. https://github.blog/changelog/2024-03-06-actions-fine-grained-permissions/ |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for the hint! 👍 |
Beta Was this translation helpful? Give feedback.
-
|
But a "View (only) GitHub Runner at org level" I'm missing... |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
View/edit org secrets and variables are now a permission The runners one may or may not be granular enough for this case. |
Beta Was this translation helpful? Give feedback.
-
|
Response #1 |
Beta Was this translation helpful? Give feedback.
-
Custom organization roles let you delegate administrative permissions to users in your organization. This feature is limited to GitHub Enterprise Cloud organizations.
If you have requests for permissions that should be added, please let us know here, and that'll help us prioritize better. Likewise, if you have any feedback or encounter bugs, you can let your account team know or let us know here.
Upcoming changes
Known issues
Beta Was this translation helpful? Give feedback.
All reactions