Install GitHub app on repo as an admin but not org owner

[eleftherias]

Select Topic Area

Question

Body

I am the owner of a GitHub organization and I would like an organization member to install a GitHub app on a repository that they are an admin of.

From the GitHub app documentation this should be possible:

Admins of repositories that are owned by an organization can also install GitHub Apps on the organization if they only grant the app access to repositories that they are an admin of and if the app does not request any organization resources. Organization owners can prevent outside collaborators who are repository admins from installing GitHub Apps.

However, the repository admin can only request to have the GitHub app installed.

I checked that the GitHub app does not request any organization resources.

Is there a way to allow users to install a GitHub app on a repository that they are an admin of? Or is it possible that that section of the documentation is outdated?

[alrnaldar]

Firstly you should to try review organization settings. Check the settings of your GitHub organization to ensure that there are no restrictions in place that might prevent repository admins from installing GitHub Apps. Look for any settings related to app installation permissions or restrictions. Also It wont be bad if you would check app permissions. Double-check the permissions that the GitHub app is requesting. Ensure that it's not requesting access to any organization-level resources, as this could prevent repository admins from installing the app.
Otherwise the most correctly way would be reach out to GitHub support. If you're still experiencing issues after reviewing the settings and permissions, consider reaching out to GitHub Support for assistance. They may be able to provide further guidance or insights into why repository admins are unable to install the app.

[eleftherias]

It is possible to have an admin install a GitHub app on a repository, even if they are not the owner of the organization.

This is not possible if the GitHub app requests read or write repository permissions for "Administration".

The reasoning is due to the repo/administration permission allowing requests that modify the organization, such as POST {org}/repo. It can more aptly be viewed as a permission to modify repos within an org as opposed to an individual repo.

In summary if a GitHub App requests "Administration" permissions on a repository, then the app can only be installed by the owner of an organization.

[vishalratnamio]

Hello @eleftherias, does this apply only to the "Administration" permissions on a repository or any other permissions as well? It looks there's a set of permissions, which if used by a GitHub app, a GitHub app admin cannot install the app to the org.
Could you point me to where you found the quoted text?

[vishalratnamio]

Found it. Basically if your GitHub app requests for "Administration" permission under Repository permissions OR any permissions under "Organisation permissions", as a GitHub add admin will not be able to install the app. Only the org admin can install such apps to the org.
From https://docs.github.com/en/apps/using-github-apps/installing-a-github-app-from-a-third-party#requirements-to-install-a-github-app:

Repository admins can install GitHub Apps in the organization that owns the repository if the app does not request any organization permissions nor the "repository administration" permission. When doing so, they can only install the app with access to the repositories that they admin.

Thank you for starting this thread, I was lost :)