Permit configurable scopes (e.g. workflows)

[cboettig]

Proposed change

Consider adding a cli option to request additional scopes? Currently, it looks like only the repo scope is set, and this choice is hardwired:

https://github.com/jupyterhub/gh-scoped-creds/blob/main/gh_scoped_creds/__init__.py#L23

Note that this means that users cannot push to repositories modifications to .github/workflows, as I believe that requires the "workflows" scope as well.

[eeholmes]

Bumping this

[eeholmes]

If you need to set a temporary PAT with workflow privleges

git remote set-url origin https://ghp_YourPersonalAccessTokenHere@github.com/username/repository.git
git push origin main

[yuvipanda]

Happy to accept a CLI param (with a env var default) for it. Anyone wanna make a PR? :D

[fperez]

I'm happy to take a stab at this - we need it more and more at CyroCloud and I'll need it for Stat 159.

Does anyone here know off hand how would one specify more than one scope? Would it be changing

data={"client_id": client_id, "scope": "repo"},

to

data={"client_id": client_id, "scope": ["repo", "workflows"]},

or is it more complicated? I can try to look it up, but if anyone knows off hand, I'd appreciate it.

I'll work out the rest of the details in terms of options, etc.

@yuvipanda - my hunch is that most people would expect it to work out of the box for workflows, since that's what they can do regardless if they go the manual route with username/password-token. So my proposed PR would:

• extend the default behavior to include workflows
• add a CLI flag and python option to exclude them if desired.

LMK if that approach sounds reasonable to you.

[fperez]

Tagging @jbbutler for visibility.

[yuvipanda]

GitHub probably changed this at some point. Adding the 'workflows' scope by default seems the way to go. Anyone wanna take a shot at it?

[fperez]

Yup, I said I would :)

If you know off hand the answer to the question above, LMK. Else I'll dig into docs and AI helpers to figure it out.

Will try to send a PR soon.