Can I give read-only access to a private repo (from a developer account)?

[FirstPrinciples-AI]

Hi everyone, apologies if this is repeating a topic discussed already. 

Can I give read-only access to my private repo, to someone who is not a collaborator at present? Can I share a url, or add someone as a read-only collaborator? I don't want to give fork/clone/download rights. 

I have a Developer account at present (not a Team/Business account, so cannot structure an organization-based acess). Here are the types of Github accounts. Thanks.

[nickcannariato · Accepted solution]

In a private repository, repository owners can only grant write access to collaborators. Collaborators can't have read-only access to repositories owned by a user account. More information about permission levels for a repository owned by a user account can be found here:

https://help.github.com/articles/permission-levels-for-a-user-account-repository/

Having said that, I know that we've heard users request these kinds of granular permissions before, and I'll add your +1 to that existing feature request.

---

@FirstPrinciples-AI wrote:

I don't want to give fork/clone/download rights. 

---

It's worth noting here that cloning a repository is a central operation in the collaboration model that GitHub provides. For example, the read-only access that we currently offer to GitHub Organizations still allows users to both clone and fork the repositories that they have permission to read:

https://help.github.com/articles/repository-permission-levels-for-an-organization/

With all of that in mind, I believe that it's unlikely that we'll change our permission model to disable the ability to clone a repository that someone has read access to; even if we do allow for read only access to private repositories owned by user accounts in the future. 

[stridera]

+1 From a security standpoint, we'd like to have a 'read only' user who can pull to keep our software up to date on hardware. However, we don't want to worry about someone getting hold of one of these devices and having access to push data (and infect all other devices)

[that-pat]

Hi @stridera,

As @nickcannariato mentioned:

The read-only access that we currently offer to GitHub Organizations still allows users to both clone and fork the repositories that they have permission to read

This does not give users the ability to push data, so this should work for your particular use case.

Hope this helps!

[demidkoy]

+1 It would be a great feature to have.

[sfindeisen]

Dear GH Team

Any plans to implement private repo access restriction for collaborators to read-only + pull-request? I want collaborators on my private (user) repo(s) put don't want to allow them direct push... Where is this feature on your roadmap?

Thanks
Stanisław

[nadiajoyce]

Hi @sfindeisen,

Thanks for this feedback! We're always working to improve GitHub, and we consider every suggestion we receive. I've logged your feature request in our internal feature request list. Though I can't guarantee anything or share a timeline for this, I can tell you that it's been shared with the appropriate teams for consideration.

Cheers!

[epodox]

+ 1 

Having more granular control on private repos for individual users is a must. Sure if they can read it they should be able to clone/fork but i want to disable specific users ability to push with out a propper pull request. Same with branching. Really should be able to have same functionallity as public for private, just we control the viewers.

Thank you,

Joshua Dooley

[WaleedMortaja]

Using protected branch ( especially for master) will give you some options, such as requesting members with write permission review to the changes before merging. You can also enforce the need for owner review. I did not tried protected branches with private reops before but I think it would be the same as the public repos.

[Septdir]

@WaleedMortajaThis is not exactly what you need.

+ 1 it would be nice to have possibly give a look at the private private repository.