The PackageMaze GitHub App

A GitHub App's access belongs to your GitHub organization, not to whichever person installs it, and can be scoped to only the repositories you choose — unlike a personal access token, which is tied to one person's account and typically grants more than any one integration needs. PackageMaze uses one App per environment as both the sign-in provider and the repository integration, so there's a single install to manage and a single place to review or revoke access.

PackageMaze mints short-lived installation tokens per request, keeps them in memory for at most an hour, and never requests or stores a refresh token. There's no long-lived GitHub credential sitting in a database.

• Sign you in. Reads your verified GitHub email once, at sign-in, to identify your PackageMaze account.
• Find your projects. Reads repository contents and structure to discover npm and PyPI project areas across the repositories you choose.
• Verify your CI. Reads a repository's CI configuration to check it's wired to publish through PackageMaze.
• Attribute your publishes. Posts a Check Run back onto the commit a verified CI run published from, so a publish is traceable to the CI run that made it.

Those things run on four permissions, each scoped as narrowly as GitHub allows:

• Contents and metadata: read-only access for repository discovery and CI verification.
• Checks: read and write access for verified publish results.
• Packages and attestations: read-only access for connected GitHub Packages and provenance verification.
• Email addresses: read-only access during GitHub sign-in.

Installing the App starts a scan of the repositories you chose in GitHub. PackageMaze creates the Projects it discovers automatically, without creating Feeds or reading lockfiles. You can ignore a Project from the Projects screen and restore it later.

You can uninstall the App from your GitHub organization's settings at any time. PackageMaze stops receiving repository access and keeps the Projects and attribution history already recorded.