Can't enable a Github Pages site from the API anymore

[did]

👋 Github folks!

Context: we developed our own Github application to build a landing page a Github page site for any repository. Behind the hood, among a lot of different GH API calls, we request the GH API Pages to enable the GH pages site automatically.

Problem: It's been working great but for an unknown reason, it stopped working a couple of days ago (maybe 2 weeks?)
This is the error the GH API returns:

403 - Resource not accessible by integration // See: https://docs.github.com/rest/pages#create-a-github-pages-site

Test: the account I used when I installed our GH app on our repository is the admin of the repository so it should have been fine.

Another test: Instead of using the token the GH installation generated for me, I also used the "classical" auth token and I received the same error. In that case, I believe it's a permission error under the hood although the error message was the same.

For now, we've disabled that functionality and tell our users to enable the GH Pages site manually but I'm curious. Is that a bug or a different behavior/workflow? In that case, what kind of token (and its permission) do I have to ask to my users?

Thanks a lot for your help!

[yoannchaudet]

Hello, this is a recent security fix. GitHub Apps never had sufficient permission to enable/disable Pages sites (one need to be a repository admin or owner to perform such an operation). While it worked in the past, this was an oversight from our part.

The best workaround now if you still need to enable Pages sites programmatically is to leverage PAT.

[did]

thank you so much @yoannchaudet!

I'm going to use PAT then.
Btw, what would be the appropriate scope? (https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps)
I don't see the one matching the Pages sites unless it's allowed by both repo or public_repo.

[yoannchaudet]

I don't believe there is a valid scope today since the API for creating/deleting Pages is not available to apps anymore. We will change that shortly and enable "user to server" scenarios. I don't have much details to share yet on all of this just that we are tracking it.

[chungwu]

Was this API taken away with any prior warnings or time frames communicated? My product had relied on this API call to create pages for our customers, and we were caught completely off guard. I just want to make sure we don't miss these communications again. Thanks!

[highb]

@yoannchaudet Are there any plans to add this permission to GH Apps? This change has completely broken our Terraform management of repos for our users and we'll have to switch to using a PAT which will hit API rate limits much faster.

Was there any advance notice of this security change provided by GitHub?

[yoannchaudet]

Hello,

We will be working on re-enabling support for GH Apps in the new year.

There is no advance notice when it's a security issue like this one. We should have a public CVE (Common Vulnerabilities and Exposures) to share soon.

[Luis-3M]

@yoannchaudet is there an ETA to have this enabled/supported again when authenticating using GitHub Apps ?

[yoannchaudet]

The fix is being validated as I write so it should be a few days away at most.

[Luis-3M]

Many thanks @yoannchaudet - looking forward to seeing support for GH Apps re-enabled.

[yoannchaudet]

The documentation is lagging behind because some automation is getting fixed but the changes are live. GitHub apps support has been restored for Pages REST API.

The main breaking change (which is the reason in the first place GitHub app support was dropped temporarily) is the following for the GET, POST and PUT on /repos/{owner}/{repo}/pages:

To use this endpoint, you must be a repository administrator, maintainer, or have the 'manage GitHub Pages settings' permission. A token with the repo scope or Pages write permission is required. GitHub Apps must have the administrative:write and pages:write permissions.

These endpoints were not previously protected and a Common Vulnerabilities and Exposures (CVE) is getting published.