# Why does galaxy need write access to github repositories?

**URL:** <https://forum.ansible.com/t/why-does-galaxy-need-write-access-to-github-repositories/20519>\
**Category:** Ansible Project\
**Tags:** galaxy-ng\
**Created:** [February 10, 2016, 5:05pm UTC](https://forum.ansible.com/t/why-does-galaxy-need-write-access-to-github-repositories/20519 "2016-02-10T17:05:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nusenu1](https://avatars.discourse-cdn.com/v4/letter/n/db5fbb/32.png) [@Nusenu1](https://forum.ansible.com/u/Nusenu1)\
**Post date:** [February 10, 2016, 5:05pm UTC](https://forum.ansible.com/t/why-does-galaxy-need-write-access-to-github-repositories/20519/1 "2016-02-10T17:05:00Z")

</div>

Hi,

when logging in into galaxy.ansible.com,  
galaxy asks for write access to repositories, why is that?

Is it possible to have a role on galaxy without giving galaxy write  
access to github repositories?

thanks,  
nusenu

---

<div class="post-metadata">

**Author:** ![Chris\_Houseknecht](https://avatars.discourse-cdn.com/v4/letter/c/c57346/32.png) [@Chris\_Houseknecht](https://forum.ansible.com/u/Chris_Houseknecht)\
**Post date:** [February 10, 2016, 6:17pm UTC](https://forum.ansible.com/t/why-does-galaxy-need-write-access-to-github-repositories/20519/2 "2016-02-10T18:17:05Z")

</div>

Galaxy asks for the following scopes used to access the GitHub API:

- user:email
- public\_repo
- read:org

These are defined here: [https://developer.github.com/v3/oauth/#scopes](https://developer.github.com/v3/oauth/#scopes)

The last two allow us to see the orgs you belong to and the repos you have access to, which is needed when building the list of role repositories on My Roles page.

–Chris

---

<div class="post-metadata">

**Author:** ![Nusenu1](https://avatars.discourse-cdn.com/v4/letter/n/db5fbb/32.png) [@Nusenu1](https://forum.ansible.com/u/Nusenu1)\
**Post date:** [February 10, 2016, 6:50pm UTC](https://forum.ansible.com/t/why-does-galaxy-need-write-access-to-github-repositories/20519/3 "2016-02-10T18:50:16Z")

</div>

Chris Houseknecht:

> Galaxy asks for the following scopes used to access the GitHub API:
> 
> - user:email  
> - public\_repo  
> - read:org
> 
> These are defined here: [https://developer.github.com/v3/oauth/#scopes](https://developer.github.com/v3/oauth/#scopes)
> 
> The last two allow us to see the orgs you belong to and the repos you have  
> access to, which is needed when building the list of role repositories on  
> My Roles page.

Ok, so you actually do not need \_write\_ access but github does not  
provide a read-only version of "public\_repo", correct?

If the user accepts

> - user:email  
> - read:org

but does not authorize

> - public\_repo

you would still be able to build that list (My Roles page) IFF his role  
is directly listed "under his account" - is that correct?

I have not seen an option in the UI to selectively authorize access but  
according to:  
[https://developer.github.com/v3/oauth/#requested-scopes-vs-granted-scopes](https://developer.github.com/v3/oauth/#requested-scopes-vs-granted-scopes)

this will "soon" be possible (pointing to a entry from 2013?  
[https://developer.github.com/changes/2013-10-04-oauth-changes-coming/](https://developer.github.com/changes/2013-10-04-oauth-changes-coming/) )