Permissions required for GitHub for Atlassian

Read-only access to actions

This permission enables access to theworkflow_run webhook event, providing information including artifacts_url, check_suite_id, conclusion, head_branch, and head_sha.

Read-only access to code scanning alerts/security events

To receive Github code scanning alerts in Jira, the app needs read permissions for security events. The app will listen to code_scanning_alert webhooks and send security report details to Jira. These will appear under the "Other links" tab of the Development Panel on Jira work items.

Read and write access to deployments

This permission allows the app access to the deployment_status webhook event to track deployments in Jira. It also enables the GitHub for Atlassian app to receive a deployment protection rule webhook and use GitHub's deployment API to approve or reject deployments. This ensures that gating results are communicated back to GitHub after a change request is approved or rejected in Jira Service Management.

Read-only access to metadata

As a mandatory requirement by GitHub, all apps have read-only metadata access by default. This is to provide access to a collection of read-only endpoints with metadata for various resources. These endpoints do not provide sensitive private repository information. Read-only metadata permissions are used for the following webhook:

• repository

Read and write access to issues and pull requests

This permission powers Smart Commit actions and allows Jira URLs to unfurl in comments. Unfurling refers to the app detecting Jira work item keys in square brackets like [ABC-123] and replacing them with respective Jira work item links.

Issues: Read and write issue permissions are used for the following webhooks:

• issue comment

• issues

Pull requests: Read and write pull request permissions are used for the following webhooks:

• pull request

• pull request review.

Notes:

1. The square brackets are required, without which the pull request may appear in the Jira work item’s Development section, but the work item key won't be expanded to a link.

2. For GitHub Enterprise integration (where the user owns the GitHub app) "Write" permission is optional. When not provided, the "unfurl" logic is gently skipped.

Read and write access to content (code)

Read permissions sync development information to Jira for the following webhooks:

• commit comment

• delete

• push

• workflow run

Write permissions allow branch creation from a work item’s dev panel.

Note: for GitHub Enterprise integration (where the user owns the GitHub app) "Write" permission is optional. When not provided, the "Create Branch" feature will not function.

Read-only access to repository administration

This permission is used when Rovo is enabled on the cloud site. It allows the app to use GitHub’s List repository teams endpoint and identify which teams have access to specific repositories. Rovo uses this information to build repository-level permissions, ensuring that search results are only shown to users with the appropriate GitHub access.

Read-only access to members

To determine if you have admin access to a GitHub organization.

Read-only access to organization administration

This permission is used when Rovo is enabled on the cloud site. It allows the app to access GitHub's Get an organization endpoint to read your organization's default repository permissions. This data is used to sync Github users and groups with the Teamwork Graph, ensuring Rovo search results are filtered based on your existing GitHub access levels.

Code scanning alert /security events

Code Scanning alert created, fixed in branch, or closed

Commit comment

A commit comment is created

Create

A Git branch or tag is created

Delete

A Git branch or tag is deleted

Deployment status

A deployment is created

Deployment protection rule

A deployment protection rule is requested for an environment.

Dependabot alert

A Dependabot alert is created, updated, or resolved.

Issue comment

Activity related to a issue or pull request comment

Issues

Activity related to a issue

Member

A user's collaborator status in a repository changes. This event is used when Rovo is enabled on the cloud site.

Membership

A user's membership in an organization is added, removed, or changed. This event is used when Rovo is enabled on the cloud site.

Organization

An organization's members or settings change. This event is used when Rovo is enabled on the cloud site.

Pull request

Activity related to pull requests

Pull request review

Activity related to pull request reviews

Pull request review comment

A comment on a pull request diff is created, edited, or deleted.

Push

One or more commits are pushed to a repository branch or tag

Repository

Activity related to a repository

Secret scanning alert

A secret scanning alert is created, resolved, or reopened.

Team

A team’s membership or repository access changes. This event is used when Rovo is enabled on the cloud site.

Workflow run

When a GitHub Actions workflow run is requested or completed