The PackageMaze GitHub App

Why a GitHub App

A GitHub App's access belongs to your GitHub organization, not to whichever person installs it, and can be scoped to only the repositories you choose — unlike a personal access token, which is tied to one person's account and typically grants more than any one integration needs. PackageMaze uses one App per environment as both the sign-in provider and the repository integration, so there's a single install to manage and a single place to review or revoke access.

PackageMaze mints short-lived installation tokens per request, keeps them in memory for at most an hour, and never requests or stores a refresh token. There's no long-lived GitHub credential sitting in a database.

What it lets PackageMaze do

• Sign you in. Reads your verified GitHub email once, at sign-in, to identify your PackageMaze account.
• Find your projects. Reads repository contents and structure to discover npm and PyPI project areas across the repositories you choose.
• Verify your CI. Reads a repository's CI configuration to check it's wired to publish through PackageMaze.
• Attribute your publishes. Posts a Check Run back onto the commit a verified CI run published from, so a publish is traceable to the CI run that made it.

What permissions that needs

Those things run on four permissions, each scoped as narrowly as GitHub allows:

• Contents and metadata: read-only access for repository discovery and CI verification.
• Checks: read and write access for verified publish results.
• Packages and attestations: read-only access for connected GitHub Packages and provenance verification.
• Email addresses: read-only access during GitHub sign-in.

Packages and attestations aren't used by anything above yet — they're reserved for two features PackageMaze hasn't shipped: adding a customer's GitHub Packages registry as a Feed upstream, and verifying build provenance against GitHub's attestation store for private packages. The App requests them now so turning either on later doesn't need a separate approval step.

Nothing is imported without approval

Installing the App only grants access — it doesn't put anything into PackageMaze by itself. PackageMaze scans only the repositories you choose during install and stages what it finds as candidates; nothing becomes a tracked project or package until you review and approve it.

You can uninstall the App from your GitHub organization's settings at any time. PackageMaze stops scanning immediately and keeps only the attribution history already recorded.