GitHub Enterprise Manager Users roles feedback (Enterprise members & Guest collaborators)

[glerchundi]

Select Topic Area

Product Feedback

Body

Hi all,

Hopefully this feedback helps and we can get first-hand response about the plans for the short-term in these matters! 🤞

We purchased a GitHub Enterprise EMU instance to cover the following use case:

• We're a group of companies.
• Each company is autonomous but we wanted to centralise everything in one place (GitHub) while also having the possibility to start sharing.
• A GitHub Organization equals to a company. One per each.
• We want to use Azure AD for SSO as well as for automatic provisioning.
• We want to start practicing InnerSourcing
• We have multiple contractors per company. Some work in multiple but others in just one of them.

So what we found is the following:

• The GitHub organizations are a good abstraction for companies ✅
• Microsoft Sign In for SSO and Azure AD for provisioning works well ✅
• We defined "No permission" as a base for repository permissions ✅
• An enterprise member that is already an organization member (is counting towards a seat) has also visibility of the rest of the internal organization repositories ❌
  • It should just have visibility over that specific organization, or at least allow configuring this behaviour.
• Guest collaborators, one we made them organization member, although the don't have visibility of the rest of the organization internal repositories, they do have access to all internal repositories within that organization ❌
  • The oursourcing / contractor should just be given access explicitly. They're not part of our organization / company and they should just have access to the specific repositories. InnerSourcing is just for employees and not for external collaborators.

Both issues are important for us but I consider the second one failing in a very basic level. Contractors are not part of the company and InnerSource is mostly thought for those people that are part of the company. Although I could envisage the current behaviour as a legit use case, it's, IMHO, the wrong default.

So, if I meant to be solving I would do the following (order means prioritisation):

1. Disable the ability to view internal repositories to guest collaborators by default. If allowing them to view is a legit use case, expose a boolean parameter like "Enable internal repository visibility to guest collaborators" (first on a enterprise level and then if requested on a organization level) that customises this behaviour. "Enable ..." because the default should be false (disabled).
2. Disable the ability to view cross organization internal repositories to enterprise members by default. As it's something that is already a product feature I would add a new parameter like "Disable cross organization internal repository visibility to enterprise members". Default is false as it's something that is already present in the product.

Does it make sense? 🙏

Thanks!