Idea: Make repository UI settings readonly

[Danielku15]

Select Topic Area

Product Feedback

Body

I thought it would be a nice feature to restrict repository admins to have only readonly access to the repository settings.

The use case: We are managing our repositories via IaC (Terraform GitHub provider) and settings, in best case, are only made through this approach. Often repository admins still incorrectly make changes manually bringing the IaC and actual state out-of-sync. Repository admins would expect to still see the repository settings but not be able to modify them through the Web UI. This has the benefit of them seeing what is configured but preventing editing. Changes on the settings can then be requested via code or via request to the admins.

This idea is adopted from JetBrains Teamcity which allows making the CI/CD settings readonly from the UI if the project is managed via code.

Current alternative: Do not make anyone an admin on the repositories. but this would not allow admins to see the overall state of their configuration. In IaC often only customizations and some individual settings are defined and some defaults and shared settings are inherited. Seeing the overall outcome via UI can have a big benefit for verifying changes and finding out what to adapt further.

The feature could work like this:

• Organization Admins can mark the UI as readonly (via API / terraform or of course via UI) for either 'only repository admins' or 'repository & organization admins'.
• The settings tab would be visible for the repository admins like today. But all UI inputs are disabled.
• Further considerations:
  • Maybe some settings need to stay read/write. e.g. secrets shouldn't be put into the IaC but remain managed manually.
  • Maybe it needs to be considered whether the setting affects both API and UI or only the UI. If IaC (e.g. terraform) is used, admins might still want to use their credentials to manage their repositories but prevent manual editing.

[gregscullard]

I'd love for role management in Github to be expanded somewhat, I am not allowed admin access to many of our repositories which means I cannot consult the list of contributors who have write access, or check branch rules or installed applications or check if a particular secret exists or not.
A readonly admin role would be extremely useful, without it, I have to ask our admin team to check on my behalf and they have better things to do ;)