Permissions? "Act on your behalf" is a bit nebulous 😅

[NullVoxPopuli]

When attempting to login with GitHub (I haven't completed this step), I see:

which "Act on your behalf" is described, by GitHub, as:

The situations in which a GitHub App acts on your behalf vary according to the purpose of the GitHub App and the context in which it is being used

which.... is very unhelpful. lol. thanks, GitHub.

Anywho -- can anything be done about this? like, specifying which permissions are actually needed? I imagine it only needs to:

• store artifacts
• comment on PRs?

any others?

[LironEr]

Hey (:
Yeah I agree, this is very unhelpful and not giving any information about what the app does with your credentials. Unfortunately, nothing can be done from my end, this screen belongs to GitHub.
See also discussion in GitHub community https://github.com/orgs/community/discussions/37117

So to clarify, If you just want to use BundleMon to monitor you don't need to log in, just install the BundleMon GitHub app.

if you want to add a review to a report on BundleMon website you need to log in (this is the message you see).
When you log in with GitHub the BundleMon service only verifies if you have write permissions to the relevant repo so that you can leave a review.

Anyway, when you log in with GitHub, the BundleMon service has access to your temporary access token, this access token has permission to the resources the BundleMon GitHub App has.

The app has write permissions to checks, commit statuses, and pull requests. See here documentation about BundleMon GitHub integration.

Hope it helped (:

[NullVoxPopuli]

it did! thanks!
NullVoxPopuli/ember-resources#897