Repository roles for an organization

You can customize access to each repository in your organization by assigning granular roles, giving people access to the features and tasks they need.

In this article

Repository roles for organizations

You can give organization members, outside collaborators, and teams of people different levels of access to repositories owned by an organization by assigning them to roles. Choose the role that best fits each person or team's function in your project without giving people more access to the project than they need.

From least access to most access, the roles for an organization repository are:

  • Read: Recommended for non-code contributors who want to view or discuss your project
  • Triage: Recommended for contributors who need to proactively manage issues, discussions, and pull requests without write access
  • Moderate: Recommended for contributors who need to moderate and edit issues, discussions, and manage pull requests without write access
  • Write: Recommended for contributors who actively push to your project
  • Maintain: Recommended for project managers who need to manage the repository without access to sensitive or destructive actions
  • Admin: Recommended for people who need full access to the project, including sensitive and destructive actions like managing security or deleting a repository

If your organization uses GitHub Enterprise Cloud, you can create custom repository roles. For more information, see Managing custom repository roles for an organization in the GitHub Enterprise Cloud documentation.

Organization owners can set base permissions that apply to all members of an organization when accessing any of the organization's repositories. For more information, see Setting base permissions for an organization.

Organization owners can also choose to further limit access to certain settings and actions across the organization. For more information on options for specific settings, see Managing organization settings.

In addition to managing organization-level settings, organization owners have admin access to every repository owned by the organization. For more information, see Roles in an organization.

Warning

When someone adds a deploy key to a repository, any user who has the private key can read from or write to the repository (depending on the key settings), even if they're later removed from the organization.

Permissions for each role

Some of the features listed below are limited to organizations using GitHub Enterprise Cloud. For more information about how you can try GitHub Enterprise Cloud for free, see Setting up a trial of GitHub Enterprise Cloud.

Note

The roles required to use security features are listed in Access requirements for security features below.

Repository actionReadTriageModerateWriteMaintainAdmin
Manage individual, team, and outside collaborator access to the repositoryโœ—โœ—โœ—โœ—โœ—โœ“
Pull from the person or team's assigned repositoriesโœ“โœ“โœ“โœ“โœ“โœ“
Fork the person or team's assigned repositoriesโœ“โœ“โœ“โœ“โœ“โœ“
Edit and delete their own commentsโœ“โœ“โœ“โœ“โœ“โœ“
Open issuesโœ“โœ“โœ“โœ“โœ“โœ“
Close issues they opened themselvesโœ“โœ“โœ“โœ“โœ“โœ“
Reopen issues they closed themselvesโœ“โœ“โœ“โœ“โœ“โœ“
Have an issue assigned to themโœ“โœ“โœ“โœ“โœ“โœ“
Send pull requests from forks of the team's assigned repositoriesโœ“โœ“โœ“โœ“โœ“โœ“
Submit reviews on pull requestsโœ“โœ“โœ“โœ“โœ“โœ“
Approve or request changes to a pull request with required reviewsโœ—โœ—โœ—โœ“โœ“โœ“
Apply suggested changes to pull requestsโœ—โœ—โœ—โœ“โœ“โœ“
View published releasesโœ“โœ“โœ“โœ“โœ“โœ“
View GitHub Actions workflow runsโœ“โœ“โœ“โœ“โœ“โœ“
Edit wikis in public repositoriesโœ“โœ“โœ“โœ“โœ“โœ“
Edit wikis in private repositoriesโœ—โœ—โœ—โœ“โœ“โœ“
Report abusive or spammy contentโœ“โœ“โœ“โœ“โœ“โœ“
Apply/dismiss labelsโœ—โœ“โœ“โœ“โœ“โœ“
Create and edit issue labelsโœ—โœ—โœ“โœ“โœ“โœ“
Delete issue labelsโœ—โœ—โœ—โœ“โœ“โœ“
Create, edit, delete pull request labelsโœ—โœ—โœ—โœ“โœ“โœ“
Close, reopen, and assign all issues and pull requestsโœ—โœ“โœ“โœ“โœ“โœ“
Enable and disable auto-merge on a pull requestโœ—โœ—โœ—โœ“โœ“โœ“
Create and edit issue milestonesโœ—โœ—โœ“โœ“โœ“โœ“
Delete issue milestonesโœ—โœ—โœ—โœ“โœ“โœ“
Create, edit, delete pull request milestonesโœ—โœ—โœ—โœ“โœ“โœ“
Apply milestonesโœ—โœ“โœ“โœ“โœ“โœ“
Mark duplicate issues and pull requestsโœ—โœ“โœ“โœ“โœ“โœ“
Request pull request reviewsโœ—โœ“โœ“โœ“โœ“โœ“
Merge a pull requestโœ—โœ—โœ—โœ“โœ“โœ“
Push to (write) the person or team's assigned repositoriesโœ—โœ—โœ—โœ“โœ“โœ“
Edit anyone's issue titles and bodiesโœ—โœ—โœ“โœ“โœ“โœ“
Edit anyone's comments on issuesโœ—โœ—โœ“โœ“โœ“โœ“
Edit and delete anyone's comments on commits, pull requests, and issuesโœ—โœ—โœ—โœ“โœ“โœ“
Hide anyone's comments on discussionsโœ—โœ“โœ“โœ“โœ“โœ“
Hide anyone's comments on issuesโœ—โœ—โœ“โœ“โœ“โœ“
Hide anyone's comments on pull requests and commitsโœ—โœ—โœ—โœ“โœ“โœ“
Lock conversations on issuesโœ—โœ—โœ“โœ“โœ“โœ“
Lock conversations on pull requests and discussionsโœ—โœ—โœ—โœ“โœ“โœ“
Transfer issues (see Transferring an issue to another repository for details)โœ—โœ—โœ“โœ“โœ“โœ“
Act as a designated code owner for a repositoryโœ—โœ—โœ—โœ“โœ“โœ“
Mark a draft pull request as ready for reviewโœ—โœ—โœ—โœ“โœ“โœ“
Convert a pull request to a draftโœ—โœ—โœ—โœ“โœ“โœ“
Create status checksโœ—โœ—โœ—โœ“โœ“โœ“
Create, edit, run, re-run, and cancel GitHub Actions workflowsโœ—โœ—โœ—โœ“โœ“โœ“
Create, update, and delete GitHub Actions secrets on GitHub.comโœ—โœ—โœ—โœ“โœ“โœ“
Create, update, and delete GitHub Actions secrets using the REST APIโœ—โœ—โœ—โœ“โœ“โœ“
Create, update, and delete GitHub Actions variables on GitHub.comโœ—โœ—โœ—โœ“โœ“โœ“
Create, update, and delete GitHub Actions variables using the REST APIโœ—โœ—โœ—โœ“โœ“โœ“
Create and edit releasesโœ—โœ—โœ—โœ“โœ“โœ“
View draft releasesโœ—โœ—โœ—โœ“โœ“โœ“
Edit a repository's descriptionโœ—โœ—โœ—โœ—โœ“โœ“
View and install packagesโœ“โœ“โœ—โœ“โœ“โœ“
Publish packagesโœ—โœ—โœ—โœ“โœ“โœ“
Delete and restore packagesโœ—โœ—โœ—โœ—โœ—โœ“
Manage topicsโœ—โœ—โœ—โœ—โœ“โœ“
Enable wikis and restrict wiki editorsโœ—โœ—โœ—โœ—โœ“โœ“
Configure pull request mergesโœ—โœ—โœ—โœ—โœ“โœ“
Configure a publishing source for GitHub Pagesโœ—โœ—โœ—โœ—โœ“โœ“
View content exclusion settings for GitHub Copilotโœ—โœ—โœ—โœ—โœ“โœ“
Manage branch protection rules and repository rulesetsโœ—โœ—โœ—โœ—โœ—โœ“
View rulesets for a repositoryโœ“โœ“โœ—โœ“โœ“โœ“
Push to protected branches
Doesn't apply to rulesets as these have a different bypass model. See Granting bypass permissions for your branch or tag ruleset.		โœ—โœ—โœ—โœ—โœ“โœ“
Merge pull requests on protected branches, even if there are no approving reviewsโœ—โœ—โœ—โœ—โœ—โœ“
Create and edit repository social cardsโœ—โœ—โœ—โœ—โœ“โœ“
Limit interactions in a repositoryโœ—โœ—โœ—โœ—โœ“โœ“
Delete an issue (see Deleting an issue)โœ—โœ—โœ—โœ—โœ—โœ“
Define code owners for a repositoryโœ—โœ—โœ—โœ“โœ“โœ“
Add a repository to a team (see Managing team access to an organization repository for details)โœ—โœ—โœ—โœ—โœ—โœ“
Manage outside collaborator access to a repositoryโœ—โœ—โœ—โœ—โœ—โœ“
Change a repository's visibilityโœ—โœ—โœ—โœ—โœ—โœ“
Make a repository a template (see Creating a template repository)โœ—โœ—โœ—โœ—โœ—โœ“
Change a repository's settingsโœ—โœ—โœ—โœ—โœ—โœ“
Manage team and collaborator access to the repositoryโœ—โœ—โœ—โœ—โœ—โœ“
Edit the repository's default branchโœ—โœ—โœ—โœ—โœ—โœ“
Rename the repository's default branch (see Renaming a branch)โœ—โœ—โœ—โœ—โœ—โœ“
Rename a branch other than the repository's default branch (see Renaming a branch)โœ—โœ—โœ—โœ“โœ“โœ“
Manage webhooks and deploy keysโœ—โœ—โœ—โœ—โœ—โœ“
Manage the forking policy for a repositoryโœ—โœ—โœ—โœ—โœ—โœ“
Transfer repositories into the organizationโœ—โœ—โœ—โœ—โœ—โœ“
Delete or transfer repositories out of the organizationโœ—โœ—โœ—โœ—โœ—โœ“
Archive repositoriesโœ—โœ—โœ—โœ—โœ—โœ“
Display a sponsor button (see Displaying a sponsor button in your repository)โœ—โœ—โœ—โœ—โœ—โœ“
Create autolink references to external resources, like Jira or Zendesk (see Configuring autolinks to reference external resources)โœ—โœ—โœ—โœ—โœ—โœ“
Enable GitHub Discussions in a repositoryโœ—โœ—โœ—โœ—โœ“โœ“
Create and edit categories for GitHub Discussionsโœ—โœ—โœ“โœ“โœ“โœ“
Move a discussion to a different categoryโœ—โœ“โœ—โœ“โœ“โœ“
Transfer a discussion to a new repositoryโœ—โœ—โœ—โœ“โœ“โœ“
Manage pinned discussionsโœ—โœ—โœ—โœ“โœ“โœ“
Lock and unlock discussionsโœ—โœ“โœ—โœ“โœ“โœ“
Individually convert issues to discussionsโœ—โœ“โœ—โœ“โœ“โœ“
Create new discussions and comment on existing discussionsโœ“โœ“โœ—โœ“โœ“โœ“
Delete a discussionโœ—โœ“โœ—โœ“โœ“โœ“
Create codespaces for private repositoriesโœ“โœ“โœ—โœ“โœ“โœ“
Create codespaces for private repositories with Codespaces secrets accessโœ—โœ—โœ—โœ“โœ“โœ“
Create codespaces for public repositories
(users with read-only access can only create codespaces at their own expense)		โœ“โœ“โœ—โœ“โœ“โœ“
Edit the custom property values for the repositoryโœ—โœ—โœ—โœ—โœ—โœ“

Access requirements for security features

In this section, you can find the access required for security features, such as GitHub Advanced Security features.

Note

Repository writers and maintainers can only directly view secret scanning alert information for their own commits. They cannot access the alert list view.

Repository actionReadTriageModerateWriteMaintainAdmin
Receive Dependabot alerts for insecure dependencies in a repositoryโœ—โœ—โœ—โœ“โœ“โœ“
Dismiss Dependabot alertsโœ—โœ—โœ—โœ“โœ“โœ“
Create security advisoriesโœ—โœ—โœ—โœ—โœ—โœ“
Manage access to GitHub Advanced Security features (see Managing security and analysis settings for your organization)โœ—โœ—โœ—โœ—โœ—โœ“
Enable the dependency graph for a private repository โœ—โœ—โœ—โœ—โœ—โœ“
View code scanning alerts on pull requestsโœ“โœ“โœ—โœ“โœ“โœ“
List, dismiss, and delete code scanning alertsโœ—โœ—โœ—โœ“โœ“โœ“
View and dismiss secret scanning alerts in a repositoryโœ—โœ—โœ—โœ“โœ“โœ“

Further reading