Skip to main content

Managing access to other repositories within your codespace

You can manage the repositories that GitHub Codespaces can access.

GitHub Codespaces 可用于使用 GitHub Team 或 GitHub Enterprise Cloud 的组织。 GitHub Codespaces 也可作为受限的 beta 版本提供给使用 GitHub Free 和 GitHub Pro 计划的个人用户。 有关详细信息,请参阅“GitHub 的产品”。

Overview

By default, your codespace is assigned a token scoped to the repository from which it was created. For more information, see "Security in GitHub Codespaces." If your project needs additional permissions for other repositories, you can configure this in the devcontainer.json file and ensure other collaborators have the right set of permissions.

When permissions are listed in the devcontainer.json file, you will be prompted to review and authorize the additional permissions as part of codespace creation for that repository. Once you've authorized the listed permissions, GitHub Codespaces will remember your choice and will not prompt you for authorization unless the permissions in the devcontainer.json file change.

Prerequisites

To create codespaces with custom permissions defined, you must use one of the following:

Setting additional repository permissions

  1. You configure repository permissions for GitHub Codespaces in the devcontainer.json file. If your repository does not already contain a devcontainer.json file, add one now. For more information, "Add a dev container to your project."

  2. Edit the devcontainer.json file, adding the repository name and permissions needed to the repositories object:

    JSON
    {
      "customizations": {
        "codespaces": {
          "repositories": {
            "my_org/my_repo": {
              "permissions": {
                "issues": "write"
              }
            }
          }
        }
      }
    }

    Note: You can only reference repositories that belong to the same personal account or organization as the repository you are currently working in.

    You can grant as many or as few of the following permissions for each repository listed:

    • actions - read / write
    • checks - read / write
    • contents - read / write
    • deployments - read / write
    • discussions - read / write
    • issues - read / write
    • packages - read
    • pages - read / write
    • pull_requests - read / write
    • repository_projects - read / write
    • statuses - read / write
    • workflows - write

    To set a permission for all repositories in an organization, use the * wildcard following your organization name in the repositories object.

    {
      "customizations": {
        "codespaces": {
          "repositories": {
            "my_org/*": {
              "permissions": {
                "issues": "write"
              }
            }
          }
        }
      }
    }
    

    To set all permissions for a given repository, use "permissions": "read-all" or "permissions": "write-all" in the repository object.

    {
      "customizations": {
        "codespaces": {
          "repositories": {
            "my_org/my_repo": {
              "permissions": "write-all"
            }
          }
        }
      }
    }
    

Authorizing requested permissions

If additional repository permissions are defined in the devcontainer.json file, you will be prompted to review and optionally authorize the permissions when you create a codespace or a prebuild configuration for this repository. When you authorize permissions for a repository, GitHub Codespaces will not re-prompt you unless the set of requested permissions has changed for the repository.

The requested permissions page

You should only authorize permissions for repositories you know and trust. If you don't trust the set of requested permissions, click Continue without authorizing to create the codespace with the base set of permissions. Rejecting additional permissions may impact the functionality of your project within the codespace as the codespace will only have access to the repository from which it was created.

You can only authorize permissions that your personal account already possesses. If a codespace requests permissions for repositories that you don't currently have access to, contact an owner or admin of the repository to obtain sufficient access and then try to create a codespace again.

Access and security

Deprecation note: The access and security setting described below is now deprecated and is documented here for reference only. To enable expanded access to other repositories, add the requested permissions to your dev container definition for your codespace, as described above.

When you enable access and security for a repository owned by your personal account, any codespaces that are created for that repository will have read permissions to all other repositories you own. If you want to restrict the repositories a codespace can access, you can limit to it to either the repository the codespace was opened for or specific repositories. You should only enable access and security for repositories you trust.

  1. 在任何页面的右上角,单击个人资料照片,然后单击“设置”。

    用户栏中的 Settings 图标

  2. 在边栏的“代码、规划和自动化”部分中,单击“ Codespaces”。

  3. Under "Access and security", select the setting you want for your personal account.

    Radio buttons to manage trusted repositories

  4. If you chose "Selected repositories", select the drop-down menu, then click a repository to allow the repository's codespaces to access other repositories you own. Repeat for all repositories whose codespaces you want to access other repositories you own.

    "Selected repositories" drop-down menu