Outside Collaborator As Admin

​

More Info:

​

Risk Level

​

Address

​

Compliance Standards

​

Remediation

​

Using Console

1. Log in to your GitHub account and navigate to the repository where the outside collaborator has been added as an admin.
2. Click on the “Settings” tab located on the right-hand side of the repository.
3. In the left-hand menu, select “Collaborators & teams.”
4. Find the outside collaborator’s name in the list of collaborators and click on the gear icon next to their name.
5. From the dropdown menu, select “Remove from team.”
6. A confirmation message will appear asking if you’re sure you want to remove the user from the team. Click “Remove.”
7. Next, in the left-hand menu, select “Teams.”
8. Find the team that the outside collaborator was a part of and click on the gear icon next to the team’s name.
9. From the dropdown menu, select “Manage access.”
10. Find the outside collaborator’s name in the list of members and click on the gear icon next to their name.
11. From the dropdown menu, select “Remove from team.”
12. A confirmation message will appear asking if you’re sure you want to remove the user from the team. Click “Remove.”
13. Finally, it’s a good idea to review your repository’s security settings to make sure that only trusted collaborators have access to sensitive information.

​

Using CLI

1. Firstly, identify the username of the outside collaborator who has been given admin access.
2. Open the command prompt or terminal and log in to your GitHub account using the gh auth login command.
3. Once you are logged in, use the gh repo collaborator remove command to remove the outside collaborator from the repository. For example, if the username of the outside collaborator is “exampleuser”, you can use the following command to remove them:
   Copy

   Ask AI

   gh repo collaborator remove exampleuser --admin
   

   This will remove the user “exampleuser” from the repository and revoke their admin access.
4. After the collaborator has been removed, you can use the gh repo collaborator add command to add them back to the repository with the appropriate access level. For example, if you want to add the user “exampleuser” back to the repository with read access, you can use the following command:
   Copy

   Ask AI

   gh repo collaborator add exampleuser --permission read
   

   This will add the user “exampleuser” back to the repository with read access.
5. Finally, it is recommended to review and update the access levels of all collaborators on the repository to ensure that they have appropriate access levels. This can be done using the GitHub web interface or the gh repo collaborator command.

​

Using Python

1. Authenticate with GitHub API using a personal access token with admin privileges.

import requests

# Replace <token> with your personal access token
headers = {
    'Authorization': 'token <token>',
    'Accept': 'application/vnd.github.v3+json'
}

2. Get the list of collaborators for the repository.

# Replace <owner> and <repo> with the repository details
url = f'https://api.github.com/repos/<owner>/<repo>/collaborators'
response = requests.get(url, headers=headers)

# Get the list of collaborators
collaborators = [collaborator['login'] for collaborator in response.json()]

3. Check if the outside collaborator is listed as an admin.

# Replace <outside_collaborator> with the username of the outside collaborator
url = f'https://api.github.com/repos/<owner>/<repo>/collaborators/{outside_collaborator}/permission'
response = requests.get(url, headers=headers)

if response.json()['permission'] == 'admin':
    # Remove the outside collaborator as admin
else:
    # No action required

4. Remove the outside collaborator as admin.

# Replace <outside_collaborator> with the username of the outside collaborator
url = f'https://api.github.com/repos/<owner>/<repo>/collaborators/{outside_collaborator}/permission'
data = {
    'permission': 'push'  # Set the permission to push
}
response = requests.put(url, headers=headers, json=data)

5. Verify that the outside collaborator has been removed as admin.

# Replace <outside_collaborator> with the username of the outside collaborator
url = f'https://api.github.com/repos/<owner>/<repo>/collaborators/{outside_collaborator}/permission'
response = requests.get(url, headers=headers)

if response.json()['permission'] != 'admin':
    print(f'{outside_collaborator} has been removed as admin.')
else:
    print(f'Failed to remove {outside_collaborator} as admin.')

​

Additional Reading:

• https://help.github.com/en/articles/adding-outside-collaborators-to-repositories-in-your-organization