Overriding an org "base role" for a select few repos

[gallexi]

Select Topic Area

Product Feedback

Body

Hello! 👋

I'm currently trying to set up permissions on repos in an org as follows:

All members of the org have read/write permissions on all repos

EXCEPT

for a small number of sensitive repos that I want to default to private, and only those (individuals or teams) explicitly added have access.

As far as I can tell, the current best way to do this is to split those few repos into a separate org, and add the small number of folks to that new org, and then make the base role on the original org "write". But, it would be cool to be able to do this directly instead!

Thanks 💖

[Tarunvaka]

Try to create a new repo

[felipegasparini-neon]

We have the exactly same problem here.
To be honest, it was frustrating to discover that the base permission overrides the PRIVATE visibility.

[jonhubby]

You can set up a more granular permission structure using teams within the same org. For the sensitive repos, create a new team with restricted access and assign only the relevant members to that team. Then, apply "read" or "no access" permissions for the other teams on those repos, while keeping the base role for everyone else as "write." This way, you don’t have to split the repos into a different org and can manage permissions directly within the same one.