Enterprise installations for GitHub Apps generally available

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> Installing GitHub Apps on your enterprise is now generally available. You can replace classic PATs with GitHub Apps in more of your enterprise and organization automation with the expanded API support detailed below. These new and expanded permissions are focused on governance, security, and administrative settings for your enterprise, with two gaps at the organization level also closed.

What’s new for GitHub Apps

Governance: Manage enterprise-level repository policies and rulesets as well as read delegated bypass requests.

Security: Configure two-factor authentication requirements, verify domains, manage IP allowlists, and control enterprise access restrictions.

Administration: Update enterprise profiles and manage both member privileges and repository access settings across the enterprise.

New permissions and API coverage

Choose the permissions your workflow needs in your GitHub App settings.

Permission

Access

Newly supported APIs and GraphQL data

Enterprise organization and repository policies

Read/write

Read policy fields on EnterpriseOwnerInfo. Update private repository forking, default repository permissions, repository visibility changes, repository creation, repository deletion, issue deletion, collaborator invitations, deploy keys, protected branch updates, dependency insights setting, organization projects setting, and repository projects.

Enterprise bypass requests

Read

Read push-rule and repository-policy bypass requests.

Enterprise settings

Read/write

Read enterprise data through EnterpriseOwnerInfo, including server installations and organization invitations. Update the enterprise profile. Read is required for access to the enterprise organization and repository policies.

Enterprise two-factor authentication

Read/write

Read two-factor fields on EnterpriseOwnerInfo. Update two-factor requirements and disallowed authentication methods.

Enterprise verifiable domains; organization verifiable domains

Write

Access VerifiableDomains for enterprises or organizations.

Enterprise IP allowlist; organization IP allowlist

Read/write

Access IpAllowListEntry and associated mutations to create, update, and delete entries on an enterprise or organization IP allowlist. Also toggle allowlist enforcement, trust of GitHub Apps, and user-level enforcement for Enterprise Managed Users.

Enterprise access restrictions

Write

Enable or disable enterprise access restrictions.

Enterprise repository rulesets

Write

Manage rulesets through the enterprise rules REST APIs and RepositoryRuleset in GraphQL.

More coverage with existing permissions

Some APIs and objects had gaps in their support for GitHub Apps. These fixes should unblock more automation scenarios with those permissions.

Permission

Access

Newly supported APIs and GraphQL data

Enterprise people

Read/write

Read EnterpriseRepositoryInfo, including repository details through EnterpriseOwnerInfo.outsideCollaborators. Add yourself to an organization with the owner or member role.

Enterprise billing

Write

Update the member purchasing setting for the Marketplace.

To get started, choose permissions for your GitHub App for the workflows you want to migrate.

These updates will be available in GHES 3.24. For details on using GraphQL with a GitHub App, see Managing an enterprise account with GraphQL. To learn more about enterprise app installations, see Installing a GitHub App on your enterprise.

The post Enterprise installations for GitHub Apps generally available appeared first on The GitHub Blog.