Permissions

Overview

gityar provides granular permission control at multiple levels: repository, team, and organization. Understanding permissions is crucial for maintaining security while enabling collaboration.

Permission Levels

Repository Level

Read Access

View repository contents
Clone repository
View issues and pull requests
Comment on issues and PRs
View wiki
Download releases

Write Access

All Read permissions
Push to repository
Create and manage branches
Create and manage issues
Create and manage pull requests
Add labels and milestones
Edit wiki pages
Manage releases

Admin Access

All Write permissions
Change repository settings
Manage collaborators
Delete repository
Transfer ownership
Manage webhooks
Manage Git hooks
Enable/disable features (Wiki, Issues, etc.)
Manage deploy keys

Organization Level

Owner

Full control over organization
Manage organization settings
Create and delete repositories
Manage all teams
Add and remove members
Manage organization billing (if applicable)

Member

Access assigned team repositories
Create repositories (if allowed)
Participate in teams
View organization page

Setting Permissions

Individual Repository

Go to repository Settings
Click "Collaboration"
Search for user
Select permission level:
- Read
- Write
- Admin
Click "Add"

Via Teams

Go to organization Teams
Select or create team
Set team permission level
Add members to team
Grant repository access to team

Organization Settings

Repository Creation:

Allow all members to create repositories
Restrict to owners only

Team Creation:

Allow all members to create teams
Restrict to owners only

Special Permissions

Branch Protection

Protect important branches (like main):

Go to Settings → Branches
Add branch protection rule
Configure:
- Require pull request reviews
- Require status checks
- Require signed commits
- Restrict who can push

Deploy Keys

Allow read or read-write access for deployment:

Go to Settings → Deploy Keys
Click "Add Deploy Key"
Add SSH public key
Choose:
- Read-only: Can only pull
- Read-Write: Can push and pull

Personal Access Tokens

Granular permissions for API access:

read:user - Read user profile
write:user - Modify user profile
read:repo - Read repository
write:repo - Modify repository
delete:repo - Delete repository
read:org - Read organization
write:org - Modify organization

Permission Inheritance

Hierarchy

Organization
  └─ Team
      └─ Repository
          └─ Individual

Rules

Individual permissions override team permissions
Team permissions apply to all team members
Organization owners have admin access to all repositories
Most restrictive permission applies when multiple sources exist

Best Practices

Security

✅ Principle of least privilege
✅ Regularly audit permissions
✅ Remove access when no longer needed
✅ Use teams instead of individual permissions
✅ Enable branch protection for main branches
✅ Require PR reviews for important changes

Collaboration

✅ Document permission structure
✅ Create teams by function or project
✅ Use Read access for external contributors
✅ Use Write access for trusted developers
✅ Reserve Admin for repository maintainers

Organization Management

✅ Limit number of organization owners
✅ Review team memberships quarterly
✅ Archive inactive repositories
✅ Document access policies
✅ Train team members on permissions

Troubleshooting

Common Issues

"Permission Denied" when pushing:

Check you have Write or Admin access
Verify you're using correct credentials
Check if branch is protected

Can't see repository:

Verify you've been added as collaborator
Check team membership
Ask organization owner for access

Can't delete repository:

Only Admin or Owner can delete
Check if repository is organization-owned

Can't add collaborators:

Need Admin access to repository
Organization owners can add to any repository

Next Steps

Learn about Teams
Explore Code Review
Read about Webhooks

Navigation

Getting Started

User Guide

Team Collaboration

Advanced

FAQ & Help