The ScaleBop GitHub App

ScaleBop connects to GitHub through one GitHub App. When you install it, GitHub shows the permissions below. This page explains what each one is for.

When ScaleBop writes to your repository

• Checking your app only reads. Importing a repository, analysing it and scanning it for security problems read your code and change nothing.
• ScaleBop writes once you start deploying, and by default through a pull request you review and merge: the AWS setup, the deploy workflow and the deploy secrets it needs.
• After launch, ScaleBop moves your production branch when you choose Ship changes (or Auto-ship, if you turn it on), and starts deploy runs when you choose Redeploy production or roll back.

Choose which repositories

When GitHub asks where to install the app, choose Only select repositories and pick the apps you want ScaleBop to work with. You can add or remove repositories later in your GitHub settings under Applications. Uninstalling the app there removes ScaleBop’s access completely.

Repository permissions

Permission	Access	What ScaleBop uses it for
Metadata	Read	Required by every GitHub App. Lists the repositories you chose and their branches.
Contents	Read and write	Read: your code, for the check and to work out how to deploy it. Write: commit the setup files to a branch for the setup pull request, and move your production branch when you ship or roll back.
Pull requests	Read and write	Open and update the setup pull request you review.
Workflows	Read and write	Add or update the deploy workflow in .github/workflows/, inside the setup pull request.
Actions	Read and write	Start a deploy run when you choose Redeploy production or roll back, and read run logs to explain a failed deploy.
Secrets	Read and write	Set the GitHub Actions secrets the deploy workflow needs, such as the AWS role it signs in with and your app’s secret settings. ScaleBop can’t read the values back; GitHub never returns secret values.
Checks	Read	Read the error annotations on a failed deploy run, to tell you which file and line failed.
Commit statuses	Read	Not used by ScaleBop today.
Merge queues	Read	Not used by ScaleBop today.
Webhooks	Read and write	Not used by ScaleBop today.

Account and organisation permissions

Permission	Access	What ScaleBop uses it for
Email addresses	Read	Not used by ScaleBop today.
Organization administration	Read	Not used by ScaleBop today.

ScaleBop signs you in through its own sign-in service, not through GitHub, so it doesn’t need your GitHub email address.