A user wants to be able to create new rulesets. We're not sure how we should go about doing that

[Rod-at-DOH]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Other

Body

One of our users has asked to be added to the Admin role in one of our repos, so he can create new rulesets. (We have a GitHub Enterprise license and we use GitHub cloud.) The other GitHub Administrators and I are not comfortable with that request. Especially since I, at least, know little about him. Anyway, I went looking for a possible role to add him to, other than Admin. There's only one that GitHub offers out-of-the-box, and that is called Maintain. Looking at it, it might do what he wants, but when I tried searching for what the Maintain role includes, I couldn't find anything. So, first question, would the Maintain role allow him to create new rulesets?

Additionally, when I looked at one repo, I've worked a lot in, I see that it is possible to modify the Admin role for that repo, by removing the destructive aspects of the Admin role. I'm sure that would do, but I'm also hesitate.

Last question, what is commonly done by businesses here on GitHub? Is it a better practice to never grant the ability to create rulesets to a person who normally would be put into the Write role? Or do businesses sometimes add such a person to either the Maintain or modified Admin role?

[shreeshasn]

No, the default Maintain role does not allow a user to create or edit repository rulesets. Managing rulesets is a sensitive permission reserved strictly for the Admin role.

In enterprise environments, granting full Admin access to a regular developer just to manage rulesets is considered a security risk, as it also allows them to delete or transfer the repository.

Since you have a GitHub Enterprise license, the common and best practice here is to create a Custom Repository Role:

1. Go to your Organization settings -> Repository roles -> Create a role.
2. Base the role on the Write or Maintain permission level.
3. Check the specific fine-grained permission box for "Edit repository rules".
4. Assign this custom role to that specific user for the repository.

This gives them full capability to build and manage rulesets without giving them any destructive admin privileges or control over the repository's visibility.