161

I am developing some private projects on Github, and I would like to add nightly cronjobs to my deployments servers to pull the latest version from github. I am currently doing this by generating keypairs on every deployment server and adding the public key to the github project as 'Deployment key'.

However, I recently found out that these deployment keys actually do have write access to the project. Hence, every of the server administrators could potentially start editing. Furthermore I can add every deployment key to only one repository, whereas I would like to be able to deploy multiple repositories on one and the same deployment server.

Is there a way to provide read-only access for private repositories to selected users on Github?

1
  • You want to have restricted read only access, isn't it? If you want unrestricted read-only access, you can use git:// protocol instead of ssh:// (ssh+git://). May 19, 2010 at 21:27

5 Answers 5

77

I have it on good authority that the (relatively new) "Organizations" feature allows you to add people with read-only access to a private repository.

4
  • 30
    That is actually a workaround as you need to create a personal account. They could've designed this better by allowing the creation of API tokens per organization with rights thus eliminating the workaround to either compromise a team member's account or to create a fake personal account.
    – nikolay
    May 29, 2013 at 4:26
  • 29
    Too bad you've got to pay $25/mo for that feature. For a small site, that $300/yr can pay for a lot of hosting elsewhere. Thanks @Trindaz Apr 30, 2014 at 15:21
  • 8
    That's why BitBucket is not a second fiddle to Github.
    – treecoder
    Mar 20, 2015 at 3:16
  • 2
    This answer is outdated. See the answer on read-only deploy keys.
    – Hauke
    Nov 25, 2017 at 11:29
52

For anyone else finding this question, know that nowadays you can in fact create read-only deploy keys:

https://github.com/blog/2024-read-only-deploy-keys

You can still create deploy keys with write access, but have to explicitly grant that permission when adding the key.

1
3

I know that the questions is about github but maybe for some readers it would be nice to know that this is possible in gitlab and for free. Check https://gitlab.com/help/user/permissions. I spend some time using github without fully serving my purposes. If I knew then I would have started this particular project with gitlab.

2

For Organizations: I suggest creating a new team specifically for the user. This team can then grant read-only access to the repositories you specify. I hope this helps!

0

Answer for GitHub in 2023:

  1. In GitHub, click on profile picture (top right) then [ Settings > Developer Settings > Personal Access Tokens > Fine Grained Tokens ].
  2. Then click on Generate New Token, select Only select repositories and choose the private repositories you want to grant read-only access to.
  3. Under Repository permissions, ensure Read access to actions, administration, code, codespaces, metadata, and security events.
  4. Copy the resultant token to the clipboard.

Now that you have a token, anybody can check out the private repository using this command line:

Example:

git clone https://myusername:[email protected]/myusername/myproject.git

Where:

  • myusername is your GitHub username
  • myproject is the Git project name.
  • github_pat_11AAJ3xxxxx is the access token you just generated. It will be much longer than this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.