Public permissions on assignment repositories

[mr-mccormick]

Thanks so much for working on this GitHub Classroom replacement. I have been a computer science teacher for only 4 years, and this will be the third lab framework jump I have had to make. (nothing -> Replit -> GitHub Classroom -> Classroom50?)

The assignment template requirements documents says that assignment templates have to be public. This is a significant concern for me. I don't want my assignments (which include the assignments and a framework I wrote that allows the students to run and test their code) publicly available on the internet. GitHub Classroom did not require this. Am I misunderstanding this or is there some workaround? For example, could I add students to a team in my organization and make the assignments visible only to members of that team?

Thanks in advance for any information on this.

[rongxin-liu]

Good point. It is possible to have a private template. As of today, you would need to manually create the team, add the relevant students to it, and grant that team access to your private template repository.

We should be able to automate this process, so I imagine it would only take a few clicks when setting up the classroom.

[ricardo-qm]

@rongxin-liu in Github classroom I put the templates for the assignments in a special organization which purpose was only have public templates for my assignments (following the principle: "separation of concerns" and in order to reuse the same public template in different assignments for diferent classrooms without copying them in the organization class). In other words: I did not use the class organization to put in the templates for the assignments.

I tried to reuse these public repositories templates in classroom50 organization but it did not recognize them. I have to copy them from my organization of public templates to the organization configured to classroom50 (by the way: they were copy as private templates without problem).

It would be possible to use public templates outside the organizations class, as my original Github Classroom strategy, in classroom50?

[rongxin-liu]

Classroom 50 now supports both private templates within the Classroom 50–configured organization and public templates, including public templates in a different organization. So the setup you want is supported.

I tried to reproduce the issue on our end. It appears that the 403 error is not a Classroom 50 limitation, but rather a GitHub setting in the template organization. This is a UX gap we should address.

Some organizations restrict third-party OAuth apps by default. When that policy is enabled, GitHub blocks the Classroom 50 OAuth app from creating a repository from that organization’s template until the app is approved.

How to fix it:

As the organization owner, you can explicitly grant the Classroom 50 OAuth app access to your organization. Students can also request access here:

https://github.com/settings/connections/applications/Ov23liDFFyDtm0pO5NN5

Alternatively, as the owner of the template organization, you can review or relax the policy here:

https://github.com/organizations/<YOUR-ORG>/settings/oauth_application_policy

Go to Organization → Settings → Third-party Access → OAuth application policy.

Once the template organization grants access to the Classroom 50 OAuth app, students should be able to accept assignments based on that public template in the web app.

Note: The CLI works without this additional setup because it authenticates through GitHub’s first-party gh CLI app, which is not subject to third-party OAuth restrictions. The web app authenticates through the Classroom 50 OAuth app, which is subject to those restrictions.

[ssardina]

@rongxin-liu , feel free to delete this message (I put it here if others are having simular issues), but as you said there this gh/organization permission level seems to be related to issue #79

[kostrzewa]

We should be able to automate this process, so I imagine it would only take a few clicks when setting up the classroom.

It would be great if this could indeed be automated in the same way that it was with github classroom. Clicking the assignment link added the students as "outside collaborators" to the organisation with access only to a subset of the repositories in the organisation (i.e. their forks of the starter repos for the various assignments that they had accepted).

This meant in particular that the templates remained private and that one could use the organisation to host other related repositories (such as solutions) without students being able to see any of these.

[brianyu28]

One notable difference between Classroom 50's architecture and GitHub Classroom is that in Classroom 50, students will be organization members rather than outside collaborators. But Classroom 50 will set the base permissions for the organization to "No permission" so that students only have access to the repositories they're explicitly granted access to, which would allow you to continue to have private solution repositories in the same organization.

[kostrzewa]

I see, thanks for the explanation!

[Talonness]

how is this done....want to make sure I understand.

so that students only have access to the repositories they're explicitly granted access to, which would allow you to continue to have private solution repositories in the same organization.

[brianyu28]

Yeah, we achieve this by setting "Base permissions" on the organization, which you can see here (replace ORGNAME with your organization's name):

https://github.com/organizations/ORGNAME/settings/member_privileges

If the base permissions are "No permission", then members by default won't have access to private repositories.