Skip to content

GitHub App Permissions

WarpFix follows the principle of least privilege. Here is every permission we request and exactly why.

WarpFix never auto-merges code. Every fix PR requires human review and approval before it reaches your codebase.

Repository contents

Read & Write

Read source files for error context; write to create fix branches

When a CI failure occurs, WarpFix reads only the specific files referenced in the error logs — not your entire repository. Write access is used exclusively to push fix branches and create pull requests. WarpFix never modifies your main/master branch directly.

Actions

Read

Read CI workflow run logs to diagnose failures

WarpFix monitors GitHub Actions workflow runs for failures. When a failure is detected, it reads the job logs to identify the error. Only failed runs are analyzed — successful runs are ignored entirely.

Pull requests

Read & Write

Open fix PRs, post review comments, respond to @warpfix mentions

Write access is used to: (1) create fix PRs with detailed descriptions, (2) post inline review comments with severity ratings, and (3) respond to @warpfix chat commands in PR comments. All PRs require human approval before merge.

Issues

Read

Cross-reference related issues when analyzing failures

Read-only access to issues allows WarpFix to link repairs to relevant open issues and provide context in fix PRs. WarpFix never creates, modifies, or closes issues.

Metadata

Read

Basic repository information for configuration

Standard metadata access provides repository name, language, default branch, and other basic info needed to configure the repair pipeline correctly for your project.

Checks

Read

Monitor CI check statuses for failure detection

WarpFix reads check run results to determine which specific checks failed and correlate them with workflow logs. This enables precise failure classification.

Webhooks

Read

Receive real-time notifications of CI events

Webhook events (workflow_run, check_run, pull_request) are how WarpFix learns about CI failures in real time. Events are processed and immediately discarded — they are not stored.

7
Permission scopes
5
Read-only scopes
2
Read & Write scopes

Minimal by design

Many CI tools request broad permissions including organization management, team membership, and deployment access. WarpFix only requests what is strictly necessary to read logs, analyze code, and open PRs. You can review the exact permissions on the GitHub App installation page.

For more details on data handling and encryption, see our Security & Data Practices page.