0

I've recently given collaborator access to a private github repo to a few new team members. While I do trust them, I'd like to better understand their read/write access. Couldn't they technically commit directly to dev or master, accept their own merge requests, or even like remove the entire project? How do I configure security settings so they can only push changes to dev/master, and I'm the only one who can merge them in?

According to https://help.github.com/articles/permission-levels-for-a-user-account-repository/, it seems that a collaborator is free to do what they want.

user3871
  • 12,432
  • 33
  • 128
  • 268

1 Answers1

0

The simplest approach would be to give access to a fork of the private repo (the fork remains private)

That way:

  • they can make pull request to your main repo, with you deciding to merge them or not.
  • they can use any branch they want on the fork.

The other approach would be to use the GitHub new protected branch feature: that can limit what a collaborator can do when merging to master.

Community
  • 1
  • 1
VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250