Skip to content

fix: allow public_repo for public contribution tools - #3140

Merged
SamMorrowDrums merged 3 commits into
github:mainfrom
paulcakeface:fix/public-repo-contribution-scopes
Sep 1, 2026
Merged

SamMorrowDrums merged 3 commits into
github:mainfrom
paulcakeface:fix/public-repo-contribution-scopes

Conversation

@paulcakeface

Copy link
Copy Markdown

Summary

Allow public-repository contribution tools to work with the narrower public_repo OAuth scope while keeping repo as an accepted parent scope.

Why

Several tools currently require repo in MCP scope metadata even though GitHub permits their public-repository operations with public_repo. That makes public-only deployments request private-repository access unnecessarily.

Fixes #3136

What changed

  • Use scopes.PublicRepo for fork_repository, create_branch, push_files, create_pull_request, issue_write, and add_issue_comment.
  • Add public_repo to the supported OAuth scope catalogue without adding it to the default grant; repo remains the default and an accepted parent scope.
  • Add focused scope-filter regression coverage and update generated documentation.

MCP impact

  • No tool or API changes
  • Tool schema or behavior changed
  • New tool added

Tool inputs and handlers are unchanged. The change affects OAuth scope filtering and advertised scope metadata only.

Prompts tested (tool changes only)

  • "Fork this public repository, create a branch, push the patch, and open a pull request."
  • "Open an issue on this public repository with the reproduction steps."

Security / limits

  • No security or limits impact
  • Auth / permissions considered
  • Data exposure, filtering, or token/size limits considered

This is a least-privilege change: public-only OAuth deployments can use public_repo without gaining private-repository access. Existing repo tokens remain compatible through the existing scope hierarchy.

Tool renaming

  • I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
  • I am not renaming tools as part of this PR

Lint & tests

  • Linted locally with ./script/lint
  • Tested locally with UPDATE_TOOLSNAPS=true go test ./...

Docs

  • Not needed
  • Updated (README / generated docs)

@paulcakeface
paulcakeface requested a review from a team as a code owner August 22, 2026 15:39
paulcakeface and others added 2 commits September 1, 2026 10:13
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Keep public_repo as a fixed-token visibility capability while requiring repo for per-call OAuth challenges. Challenge only missing scopes for workflow pushes.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@SamMorrowDrums
SamMorrowDrums merged commit 198bc16 into github:main Sep 1, 2026
22 of 28 checks passed
social4hyq pushed a commit to social4hyq/homebrew-core that referenced this pull request Sep 20, 2026
github-mcp-server 1.12.0

Created-by: HarmonybrewBot
Commit-by: HarmonybrewBot
Merged-by: HarmonybrewBot
Description: Created by `brew bump`

---

Created with `brew bump-formula-pr`.<details>
  <summary>release notes</summary>
  <pre>## Highlights

- **New governance tools for agents.** Read and manage repository rulesets and custom properties across repository, organization, and enterprise levels.
- **Faster, safer feature flags.** Functional availability rules evaluate lazily after static filtering, deduplicate checks per request, and preserve precise availability errors.
- **Safer write operations.** Pin merge HEADs, recover file SHAs, use least-privilege public-repository access, and detect silently dropped labels.
- **Richer review and discovery support.** Adds review range coordinates, thread resolution reasons, projected-header preflights, Server Card support, and Agent Plugins.
- **Better content fidelity.** Markdown bodies, titles, release notes, comments, and commit messages preserve visible content while filtering unsafe invisible characters.

## What's Changed
* Remove documentation for unavailable tool-search command by @tommaso-moro in github/github-mcp-server#3162
* Expose Copilot review thread resolution reasons by @cagesellchen in github/github-mcp-server#3123
* fix(repos): give create_or_update_file callers a SHA they can actually get by @dylanpulver in github/github-mcp-server#3131
* fix: allow public_repo for public contribution tools by @paulcakeface in github/github-mcp-server#3140
* Enable feature flags via URL query parameter (?features=) for headerless hosted connections by @CAOShurong in github/github-mcp-server#3146
* Add expectedHeadSha pinning to merge_pull_request by @jcosta1970 in github/github-mcp-server#3182
* Fix e2e harness compilation against go-github v89 and go-sdk v1.7 by @ppoffice in github/github-mcp-server#3187
* Return range coordinates for review comments by @yiheng-kkk in github/github-mcp-server#3193
* Fix issue_write silently dropped label errors by @SamMorrowDrums in github/github-mcp-server#3195
* fix(http): allow projected MCP headers in preflights by @SamMorrowDrums in github/github-mcp-server#3167
* Spell perPage the same way in every paginated tool by @karpovantonme in github/github-mcp-server#3142
* Add MCP Server Card (SEP-2127) types + handler by @SamMorrowDrums in github/github-mcp-server#2768
* Refactor feature flags to use functional availability rules by @SamMorrowDrums in github/github-mcp-server#3166
* feat(governance): add repository ruleset tools with multi-level scope challenge by @SamMorrowDrums in github/github-mcp-server#2991
* feat(governance): add custom properties tools by @SamMorrowDrums in github/github-mcp-server#2992
* Fix HTML entities in sanitized titles by @SamMorrowDrums in github/github-mcp-server#3216
* build(deps): bump fast-uri from 3.1.5 to 3.1.7 in /ui in the npm_and_yarn group across 1 directory by @dependabot[bot] in github/github-mcp-server#3208
* build(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in github/github-mcp-server#3217
* build(deps): bump github/codeql-action from 4.37.4 to 4.37.9 by @dependabot[bot] in github/github-mcp-server#3192
* feat: add Agent Plugins 1.0 package by @777genius in github/github-mcp-server#3169
* fix(sanitize): preserve Markdown body fidelity on read surfaces by @SamMorrowDrums in github/github-mcp-server#3177
* build(deps): bump actions/stale from 10 to 11 by @dependabot[bot] in github/github-mcp-server#3003
* Fix main CI sanitizer integration by @SamMorrowDrums in github/github-mcp-server#3219

## New Contributors
* @cagesellchen made their first contribution in github/github-mcp-server#3123
* @paulcakeface made their first contribution in github/github-mcp-server#3140
* @CAOShurong made their first contribution in github/github-mcp-server#3146
* @jcosta1970 made their first contribution in github/github-mcp-server#3182
* @ppoffice made their first contribution in github/github-mcp-server#3187
* @yiheng-kkk made their first contribution in github/github-mcp-server#3193
* @karpovantonme made their first contribution in github/github-mcp-server#3142
* @777genius made their first contribution in github/github-mcp-server#3169

**Full Changelog**: https://github.com/github/github-mcp-server/compare/v1.11.0...v1.12.0</pre>
  <p>View the full release notes at <a href="https://github.com/github/github-mcp-server/releases/tag/v1.12.0">https://github.com/github/github-mcp-server/releases/tag/v1.12.0</a>.</p>
</details>
<hr>

See merge request: Harmonybrew/homebrew-core!18304
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Allow public_repo scope for public repository write tools

3 participants