How do I find out who has access to a repository?

[simon-friedberger]

Select Topic Area

Question

Body

I have a forked repository from which I have made PRs with "allow edits by maintainers". That means that the maintainers can now push to that repository but the collaborators section of the settings still says

Direct access

0 collaborators have access to this repository. Only you can contribute to this repository.

How can I find out who actually has access?

[simon-friedberger]

That seems potentially difficult. How do I find out if any PR had the flag set after contributing to a repo for a while?

[simon-friedberger]

But that means I basically have to write a script that iterates over all PRs to find out if it has been set at some point, right?

[shemayon]

Yes, to check whether the "Allow edits by maintainers" option was enabled for past PRs, you would need to go through each PR individually. This can indeed be automated using a script that interacts with the GitHub API.

You can write a script that iterates through all the pull requests in a repository and checks the maintainer_can_modify field. Here's a simple outline in Python using the requests library to get started:

import requests

# Replace with your GitHub personal access token
GITHUB_TOKEN = 'your_github_token'
# Replace with the repository owner and name
OWNER = 'repo_owner'
REPO = 'repo_name'

# GitHub API URL for listing pull requests
url = f'https://api.github.com/repos/{OWNER}/{REPO}/pulls'

# Set the headers for authentication
headers = {
    'Authorization': f'token {GITHUB_TOKEN}',
    'Accept': 'application/vnd.github.v3+json'
}

# Get a list of pull requests
response = requests.get(url, headers=headers)
pull_requests = response.json()

# Loop through the pull requests and check for maintainer edits permission
for pr in pull_requests:
    pr_number = pr['number']
    pr_details_url = f'https://api.github.com/repos/{OWNER}/{REPO}/pulls/{pr_number}'
    
    # Get details for each pull request
    pr_details_response = requests.get(pr_details_url, headers=headers)
    pr_details = pr_details_response.json()

    # Check if maintainers can modify the PR
    if pr_details.get('maintainer_can_modify'):
        print(f'PR #{pr_number} allows edits by maintainers.')
    else:
        print(f'PR #{pr_number} does not allow edits by maintainers.')

This script:

1. Fetches the list of pull requests in your repository.
2. For each pull request, it retrieves detailed information, specifically checking if maintainer_can_modify is set to true.
3. Prints whether the PR allows edits by maintainers.

You'll need to create a GitHub personal access token with appropriate permissions to authenticate API requests. You can then adapt this script to gather data on any number of pull requests.

If you're dealing with a large number of PRs, you might need to paginate through the results since the GitHub API returns a limited number of PRs per request (usually 30 by default).

[simon-friedberger]

Thanks for the script. I think I'll leave this open for now, hoping that somebody from GH sees this and understands that it's a problem if you have to get a script from here to figure out who can access your repos. - Or convinces me otherwise.

[ghostinhershell]

Hi @simon-friedberger, thanks so much for reaching out. You should be able to see which collaborators have access to your repository under Collaborators & Teams in your repository settings page.

1. On GitHub, navigate to the main page of the repository.
2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.
   
3. In the "Access" section of the sidebar, click Collaborators & teams.

[simon-friedberger]

Maintainers of repositories which have received PRs from me are not listed there.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[simon-friedberger]

Is there anybody from Github here who could turn this into an issue?