Excessive permissions using Github login

[ValYouW]

Hi,

When signing in using Github it seems that Liveshare asks for too much permissions, while only email seems necessary, it also asks for read/write to public/private repositories, and full permissions for Discussions.
Why? can I limit this to email only?
Thx

[fubaduba]

@Davsterl do we have any anwers here?

[olegoid]

@fubaduba we have an internal discussion about this issue.

[Davsterl]

Yes, we will look into changing the permissions here.

[olegoid]

Fixed in Live Share v1.0.3912

[ValYouW]

Thanks!

[scooper91]

Just had to re-auth with GitHub, and alongside the existing permissions discussed above, it's also now requiring the ability to "Update GitHub Action Workflow files" ("This application will be able to remove, edit GitHub Action Workflow files for your repositories.").

Why does it require all these permissions to use Live Share?

[sebastiantf]

Just saw this now. Been using Live Share till yesterday, and all of a sudden, today it asked me again to Login with GitHub/Microsoft. When choosing GitHub, it requests write access to public and private repos

v1.0.5723

[radekn]

I tried to use Live Share (v1.0.5762) today, and it asked me for the following permissions:

Personal user data

Email addresses (read-only), profile information (read-only)
This application will be able to read your private email addresses and read your private profile information.

Repositories

Public and private
This application will be able to read and write all public and private repository data. This includes the following:

• Code
• Issues
• Pull requests
• Wikis
• Settings
• Webhooks and services
• Deploy keys
• Collaboration invites

Workflow

Update GitHub Action Workflow files.
This application will be able to remove, edit GitHub Action Workflow files for your repositories.

Given that the only purpose for this is authentication, declining felt like the only sane choice.
I don't think it should need any of that except public profile information (assuming GitHub authentication allows such granularity) and maybe email address.

[raphaelsetin]

It's still asking all the above as @radekn mentioned in the latest stable VS Code of today.

[sbromberger]

Is there any consideration being given to changing this? There is no reason for live share to need access to my private repos - this overbroad set of permissions is the sole reason I can't use it.