Why does GitHub Copilot need read/write access to private repositories?

[ayaankazerouni]

Select Topic Area

Question

Body

Hello! I'm seeing the following authentication pop-up in VSCode for GitHub Copilot Chat, which is an extension pack that appears to have GitHub Copilot as its only extension. I've had Copilot installed, but I haven't seen this pop up before, so I assume it's part of a recent update.

If I click "Allow", I am taken to the following authentication screen, where I am asked to provide read and write access to public and private repositories owned by me or the organizations I'm part of.

So I have a few questions that I'm hoping someone can shed some light on. Thanks!

1. Why does the VSCode Copilot extension need write access to my repositories on GitHub? One would expect a VSCode extension to only need write access to files in VSCode.
2. Why does it need any access to my private repositories on GitHub? The extension README links to this Privacy Policy, but I didn't see any details about GitHub Copilot's usage of private repository access.
3. How can I only provide access to my repositories, and not those of organizations to which I belong?
   • For starters, I am not the owner (just a member) of many of the organizations listed on the authentication page, so it's not appropriate for me to make that choice one way or another.
   • Second, I use GitHub Classroom in classes that I teach, which means hundreds of students' submissions are housed under GitHub organizations that I own. I do not want to provide access to those repositories to Copilot, but I don't see any controls for disallowing that access for particular organizations.

I'd appreciate any help or guidance. Thank you!

[all-iver]

Edit - I think this is the relevant GitHub issue: microsoft/vscode-copilot-release#813

For anyone looking for a workaround for Copilot (not chat), I installed the older version (1.156.0) of the GitHub Copilot extension and it works again without asking for these new permissions. You can also install an older version of the GitHub Copilot Chat extension to get it to stop bugging you, but it seems that it's broken - I don't want to use it anyway, but you can't install one without the other.

The only information I can find is in the VS Code 1.86 notes, where it says "To enable additional workspace search features for private repositories, we require additional permissions." I don't understand what that means, or what that feature is supposed to do, but it seems like this extension is now asking for basically every possible permission when previously it just needed my email address. I agree with what @ayaankazerouni said above about granting full permissions to repos I don't even own, or my company's repos.

[vdods]

Can confirm that 1.156.0 works without additional permissions.

I'll second the OP. Copilot is a tool for the project you're working on locally. That should work regardless of use of git or github (except for the authentication required to use Copilot in the first place), and should not need to know anything about any of your repositories anywhere, let alone gain write access to them. It should operate on code through VSCode, not through github.

Copilot should roll back that access requirement.

[ianb-mp]

I just tried 1.156.0 and it is asking for read + write access to all my repositories.

[ramesh2051]

[queenofcorgis]

@ramesh2051,

We’ve clarified our stance on using generative AI tools like ChatGPT within our Community via this announcement. Please review the guidelines to ensure your post meets them as failure to adhere to those rules can result in action taken by our moderator team.  You can read our updated Code of Conduct and the announcement for more details. Thank you for helping us maintain an authentic and beneficial space for everyone.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[dandv]

I'm still running into this issue while trying to install GitHub Copilot v1.194.0.

I didn't have this problem installing the GitHub Copilot extension for WebStorm, so I've switched to WebStorm.