For one repository in an organization, grant a person or team the Read role from the repository’s Settings → Collaborators & teams page. For read access across an organization’s repositories, an owner can set organization-wide base permissions—but that affects all current and future members, so use it only when that broader access is intended. Private repositories owned by personal accounts do not offer read-only collaborator access.
Choose the right access method
| Situation | Use this method | Scope and limits |
|---|---|---|
| One organization repository; recipient is a member | Add the person or a team to that repository and choose Read. | Applies to that repository. Repository administrators can manage access. GitHub Docs |
| One organization repository; recipient is not a member | Add the person as an outside collaborator and assign a repository role. | Outside collaborators cannot be added to teams. An invitation to a private repository may require a paid license, depending on the organization’s plan. GitHub Docs |
| All repositories for organization members | Set the organization’s base repository permission. | Affects existing and new members, but not outside collaborators. Higher repository-specific grants can override the base permission. GitHub Docs |
| All repositories for an existing user under an eligible plan | Check whether the predefined All-repository read role is available. | GitHub’s role-permissions documentation identifies this role as available for GitHub Enterprise Cloud. Confirm availability in your organization before relying on it. GitHub Docs |
| Private repository owned by a personal account | Transfer the repository to an organization if collaborators need read-only access. | For a private personal repository, collaborators can only be granted write access. GitHub Docs |
Grant Read access to one organization repository
- Open the repository and select Settings.
- Under Access, select Collaborators & teams.
- Select Add people or Add teams.
- Find and select the person or team.
- Under Choose a role, select Read, then confirm the addition.
- To change existing access instead, find the person or team on the same page and change the Role dropdown to Read.
Repository administrators can manage people and teams on this page. Organization owners and team maintainers can grant teams read access to organization repositories. GitHub Docs GitHub Docs
As an Amazon Associate I earn from qualifying purchases.
What the Read role permits
Read is the lowest organization repository role. GitHub describes it as “Recommended for non-code contributors who want to view or discuss your project.” It permits pulling repository content and, among other actions, viewing published releases and Actions workflow runs, opening issues, commenting, and submitting pull-request reviews. It does not permit pushing changes or managing repository access. GitHub Docs
Triage is not simply another name for read-only access: it adds issue and pull-request management capabilities without granting code-write access. Choose it only when the recipient needs that additional project-management work. GitHub Docs
#1 Best Overall
Set organization-wide base permissions
An organization owner can set a default repository permission for organization members in Organization Settings → Member privileges → Base permissions. Base permissions apply to current and new members. They do not apply to outside collaborators, and a higher repository-specific permission can override the default. GitHub Docs
This is broader than granting Read on one repository: it changes the default across the organization’s repositories for its members. Internal repositories also have a minimum visibility level of Read, even if the base permission is set to none. GitHub Docs
Account for membership and team boundaries
- Outside collaborators: They are not organization members and cannot be added to teams. Grant their repository access individually. GitHub Docs GitHub Docs
- Nested teams: Teams inherit repository access from their parent teams. Before nesting teams or changing a team hierarchy, check that parent-team grants are appropriate for child teams too. GitHub Docs
- Personal-account repositories: Public repositories can be viewed without adding someone as a collaborator. A private personal repository cannot provide a collaborator with read-only access; use an organization repository for granular roles. GitHub Docs
Audit other access paths and plan for removal
Repository deploy keys are separate from collaborator and team roles. Someone with a private repository’s deploy key can retain read or write access according to the key’s settings, even after removal from the organization. Review deploy keys separately when auditing access. GitHub Docs
Removing someone’s access does not erase their local clone. For private organization repositories, a private fork may be deleted when access is removed, but clones remain; GitHub places responsibility on the organization to ensure former collaborators delete confidential information. GitHub Docs
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
