Question

A team of contractors needs to triage issues and pull requests in a private repository, plus manage repository labels and milestones. Company policy requires least-privilege access, and the contractors must NOT be able to push code, merge pull requests, or change repository settings. The organization owner wants a reusable role that can be applied across several repositories. What is the best way to grant this access?

Accepted Answer

Create a custom repository role based on the Triage role, add the 'Manage labels' and 'Manage milestones' permissions, and assign it to the contractors

Answer

Assign the contractors the built-in Write role on each repository

Answer

Assign the contractors the built-in Maintain role so they can manage issues and milestones

Answer

Add the contractors as outside collaborators with the Read role and rely on branch protection rules to block merges