#76 research: GitHub App installation token scope limitations

[Anonymous]

Originally created by: kumaakh

GitHub App installation tokens minted by provision_vcs_auth have restricted permissions that cause friction:

1. Cannot push workflow files (.github/workflows/*.yml) — requires workflows permission, not available on fine-grained tokens by default
2. gh CLI compatibility — installation tokens may not work with all gh commands (e.g. gh pr merge, gh api) that expect OAuth/PAT
3. Workaround today: PM creates PRs and merges from the controller (full gh auth), or user manually pushes CI files

Research questions:

• Can the GitHub App be configured with workflows permission at the App level?
• Does gh CLI work with installation tokens at all?
• Should we mint broader-scoped tokens, or keep them narrow and route CI/gh operations through PM permanently?

Backlog item [#15] from docs/MCP-BACKLOG.md. High priority.

[Anonymous]

Originally posted by: kumaakh

Research complete. GitHub App installation tokens are minted with configurable repo scope (repos param) and access level (git_access param) in provision_vcs_auth. The mint call in src/services/vcs/github.ts passes these through to the GitHub App API. Full analysis documented in issue [#163] (credential file isolation redesign). Closing research issue.

[Anonymous]

Ticket changed by: kumaakh

• status: open --> closed