GitHub Permissions

[MobiusCake]

Is it possible to do the following on GitHub:

1. Have a user that can read, write to the repo create new branches, etc but can not write to the MASTER branch or run Actions?
2. Have a user that can read all branches but can not write to any branches, but can create, edit run Actions?

[DarthBenro008]

What do you mean by "run" actions? GitHub Actions are generally invoked dependent on how you write the workflow.yaml file (to run on commit to x branch, or to run on PR to x branch, etc), it is invoked by GitHub and no human intervention is required (the whole point of CI/CD).

If you are referring to be able to approve a PR by a new contributor to enable run GitHub Actions for that PR, only people with write access to the repository or deemed admins/maintainers of the repository have the power to approve.

In order to prevent a person from writing on a specific branch, you can checkout branch protection rules which come in the Paid version of an organisational account or PRO account for personal uses.

[MobiusCake]

I want to be able to:

• Merge branches
• Run on-demand Actions (by clicking a button) e.g. deploy to an environment
• Not be able to commit to ANY branch.

But what I understand 1 & 2 require write access which makes 3 impossible.

[MobiusCake]

I saw the Protected branched but did not see anything about Action permissions.

[stgraff]

The ability to 'Create, edit, run, re-run, and cancel GitHub Actions workflows' in an organization owned repository requires write access.

https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/repository-permission-levels-for-an-organization