Can I give read-only access to a private repo (from a developer account)?

[FirstPrinciples-AI]

Hi everyone, apologies if this is repeating a topic discussed already. 

Can I give read-only access to my private repo, to someone who is not a collaborator at present? Can I share a url, or add someone as a read-only collaborator? I don't want to give fork/clone/download rights. 

I have a Developer account at present (not a Team/Business account, so cannot structure an organization-based acess). Here are the types of Github accounts. Thanks.

[nickcannariato · Accepted solution]

In a private repository, repository owners can only grant write access to collaborators. Collaborators can't have read-only access to repositories owned by a user account. More information about permission levels for a repository owned by a user account can be found here:

https://help.github.com/articles/permission-levels-for-a-user-account-repository/

Having said that, I know that we've heard users request these kinds of granular permissions before, and I'll add your +1 to that existing feature request.

---

@FirstPrinciples-AI wrote:

I don't want to give fork/clone/download rights. 

---

It's worth noting here that cloning a repository is a central operation in the collaboration model that GitHub provides. For example, the read-only access that we currently offer to GitHub Organizations still allows users to both clone and fork the repositories that they have permission to read:

https://help.github.com/articles/repository-permission-levels-for-an-organization/

With all of that in mind, I believe that it's unlikely that we'll change our permission model to disable the ability to clone a repository that someone has read access to; even if we do allow for read only access to private repositories owned by user accounts in the future. 

[stridera]

+1 From a security standpoint, we'd like to have a 'read only' user who can pull to keep our software up to date on hardware. However, we don't want to worry about someone getting hold of one of these devices and having access to push data (and infect all other devices)

[that-pat]

Hi @stridera,

As @nickcannariato mentioned:

The read-only access that we currently offer to GitHub Organizations still allows users to both clone and fork the repositories that they have permission to read

This does not give users the ability to push data, so this should work for your particular use case.

Hope this helps!

[demidkoy]

+1 It would be a great feature to have.

[ettalhi]

I think it is a good idea to add a read-only permission that allows a developer to share a URL of his code to an employer for example during a technical test.

[amehtaSF]

+1 on this feature request! Please!

[antho-girard]

Hi,

For Organizations, what about a specific permission level so our customers (external collaborators) can only create issues (and why not read-only access to projects/wiki too?) inside private repos?

Currently they also have access to code + pull requests and they use paid seats which is problematic for us.

EDIT : (I'm talking about the "Team" plan)

Thanks,

[sfindeisen]

Dear GH Team

Any plans to implement private repo access restriction for collaborators to read-only + pull-request? I want collaborators on my private (user) repo(s) put don't want to allow them direct push... Where is this feature on your roadmap?

Thanks
Stanisław

[nadiajoyce]

Hi @sfindeisen,

Thanks for this feedback! We're always working to improve GitHub, and we consider every suggestion we receive. I've logged your feature request in our internal feature request list. Though I can't guarantee anything or share a timeline for this, I can tell you that it's been shared with the appropriate teams for consideration.

Cheers!