What permissions should I use?

[justinmchase]

The docs say to use one of the permisisons admin, push, pull.

But these don't align with with Roles in my orgs.

Is there any documentation on what Role will be applied if I use "push" in this case? Or should I be using permission names such as maintain instead of push or pull if those are the Roles defined in my org?

[svg153]

Hi. We are using admin, push, pull in our safe-settings configuration. So, I could confirm you thatpull works as a read, and pull as a write. But we have not yet tested these "new roles" or the custom roles.

[justinmchase]

Ok, not gonna lie, I'm confused. Sorry, not trying to be obtuse but if I use the permission: maintain will it not set the team correctly?

Does the permission value just need to match the name of the role you wish to assign the team to, regardless of the organizations roles? Or is this a bug in this app where "push", "pull" and "admin" are the only roles supported?

[svg153]

Forgive me, I didn't explain myself well, either.

After looking at the safe-settings code for teams, and the GitHub API for teams, it seems to only support this list of roles:

The permission to grant the team on this repository. We accept the following permissions to be set: pull, triage, push, maintain, admin

It also supports custom roles created, but I don't know how to assign them through safe-settings… I don't know if putting the name of the role would work, or it would have to be the identifier.

So even though the read and write appear in the interface, they are not valid identifiers for the API. Looks like some UX.

[justinmchase]

Ok so you're saying Read and Write are just labels on the drop down but when it calls the api its actually sending "pull" and "push" and those are the actual valid settings settings bot is using.

What about custom roles? They also have identifiers?

[svg153]

After some tests:

• GitHub API (with new and legacy API)
• safe-settings in my org (use the old legacy API for teams)

I could confirm you, that safe-settings works for custom roles with the name, btw double quotes permission: "Custom Role 3"

For example:

• Create manually these teams in your organization: "test_custom_role", "test_custom_role_2", "test_custom_role_3"
• Create manually these roles in your organization: "customrole", "custom role 2", "Custom Role 3".
• In the repository (or settings.yml) add the team part as below, for example, for api.yml repository.

repository:
  name: api
teams:
  - name: test_custom_role
    permission: "customrole"
  - name: test_custom_role_2
    permission: "rustom role 2"
  - name: test_custom_role_3
    permission: "Custom Role 3"

[justinmchase]

So the permission field should match the Role name. Thanks.