Enterprise installations for GitHub Apps generally available
Installing GitHub Apps on your enterprise is now generally available. You can replace classic PATs with GitHub Apps in more of your enterprise and organization automation with the expanded API support detailed below. These new and expanded permissions are focused on governance, security, and administrative settings for your enterprise, with two gaps at the organization level also closed.
What’s new for GitHub Apps
- Governance: Manage enterprise-level repository policies and rulesets as well as read delegated bypass requests.
- Security: Configure two-factor authentication requirements, verify domains, manage IP allowlists, and control enterprise access restrictions.
- Administration: Update enterprise profiles and manage both member privileges and repository access settings across the enterprise.
New permissions and API coverage
Choose the permissions your workflow needs in your GitHub App settings.
| Permission | Access | Newly supported APIs and GraphQL data |
|---|---|---|
| Enterprise organization and repository policies | Read/write | Read policy fields on EnterpriseOwnerInfo. Update private repository forking, default repository permissions, repository visibility changes, repository creation, repository deletion, issue deletion, collaborator invitations, deploy keys, protected branch updates, dependency insights setting, organization projects setting, and repository projects. |
| Enterprise bypass requests | Read | Read push-rule and repository-policy bypass requests. |
| Enterprise settings | Read/write | Read enterprise data through EnterpriseOwnerInfo, including server installations and organization invitations. Update the enterprise profile. Read is required for access to the enterprise organization and repository policies. |
| Enterprise two-factor authentication | Read/write | Read two-factor fields on EnterpriseOwnerInfo. Update two-factor requirements and disallowed authentication methods. |
| Enterprise verifiable domains; organization verifiable domains | Write | Access VerifiableDomains for enterprises or organizations. |
| Enterprise IP allowlist; organization IP allowlist | Read/write | Access IpAllowListEntry and associated mutations to create, update, and delete entries on an enterprise or organization IP allowlist. Also toggle allowlist enforcement, trust of GitHub Apps, and user-level enforcement for Enterprise Managed Users. |
| Enterprise access restrictions | Write | Enable or disable enterprise access restrictions. |
| Enterprise repository rulesets | Write | Manage rulesets through the enterprise rules REST APIs and RepositoryRuleset in GraphQL. |
More coverage with existing permissions
Some APIs and objects had gaps in their support for GitHub Apps. These fixes should unblock more automation scenarios with those permissions.
| Permission | Access | Newly supported APIs and GraphQL data |
|---|---|---|
| Enterprise people | Read/write | Read EnterpriseRepositoryInfo, including repository details through EnterpriseOwnerInfo.outsideCollaborators. Add yourself to an organization with the owner or member role. |
| Enterprise billing | Write | Update the member purchasing setting for the Marketplace. |
To get started, choose permissions for your GitHub App for the workflows you want to migrate.
These updates will be available in GHES 3.24. For details on using GraphQL with a GitHub App, see Managing an enterprise account with GraphQL. To learn more about enterprise app installations, see Installing a GitHub App on your enterprise.
The post Enterprise installations for GitHub Apps generally available appeared first on The GitHub Blog.