GitHub App Permissions
WarpFix follows the principle of least privilege. Here is every permission we request and exactly why.
WarpFix never auto-merges code. Every fix PR requires human review and approval before it reaches your codebase.
Repository contents
Read & WriteRead source files for error context; write to create fix branches
When a CI failure occurs, WarpFix reads only the specific files referenced in the error logs — not your entire repository. Write access is used exclusively to push fix branches and create pull requests. WarpFix never modifies your main/master branch directly.
Actions
ReadRead CI workflow run logs to diagnose failures
WarpFix monitors GitHub Actions workflow runs for failures. When a failure is detected, it reads the job logs to identify the error. Only failed runs are analyzed — successful runs are ignored entirely.
Pull requests
Read & WriteOpen fix PRs, post review comments, respond to @warpfix mentions
Write access is used to: (1) create fix PRs with detailed descriptions, (2) post inline review comments with severity ratings, and (3) respond to @warpfix chat commands in PR comments. All PRs require human approval before merge.
Issues
ReadCross-reference related issues when analyzing failures
Read-only access to issues allows WarpFix to link repairs to relevant open issues and provide context in fix PRs. WarpFix never creates, modifies, or closes issues.
Metadata
ReadBasic repository information for configuration
Standard metadata access provides repository name, language, default branch, and other basic info needed to configure the repair pipeline correctly for your project.
Checks
ReadMonitor CI check statuses for failure detection
WarpFix reads check run results to determine which specific checks failed and correlate them with workflow logs. This enables precise failure classification.
Webhooks
ReadReceive real-time notifications of CI events
Webhook events (workflow_run, check_run, pull_request) are how WarpFix learns about CI failures in real time. Events are processed and immediately discarded — they are not stored.
Minimal by design
Many CI tools request broad permissions including organization management, team membership, and deployment access. WarpFix only requests what is strictly necessary to read logs, analyze code, and open PRs. You can review the exact permissions on the GitHub App installation page.
For more details on data handling and encryption, see our Security & Data Practices page.