Access control

With roles and permissions management, you can ensure that each member has the right level of access to perform their duties without compromising the security of your codebase. In this documentation, we’ll walk you through how to manage team members, assign roles, and control access to your team’s repositories.

​

Repository permission levels for a team

People with admin permissions can manage access level of an individual to a team owned repository. Each permission level increases access to a repository’s content and settings. Choose the level that is the most appropriate for a person’s role in your project without giving people more access than they need. In the order of least to most access, the permission levels for a repository are:

• Read-only: Recommended for non-code contributors who only want to view the dashboard, without modifying anything.
• Write: Recommended for people who actively push code to the project, who need the ability to modify settings.
• Admin: Recommended for people who need full access, including the ability to add or remove people to the repository.

Action	Admin	Write	Read-only
View issues
View past runs
View metrics
View overview widgets
Customize overview widgets
Install Autofix App
Create Autofixes
Can view DSN
Generate SSH key-pair
Change default analysis branch
Change issue types to report
Change issues to type to block PRs on
Deactivate analysis on repository
Add/remove members
Update role of existing members
Ignore issues		^	^
Modify metric thresholds		^^	^^
Suppress failed metrics		^^^	^^^

^ If Allow contributors or members to ignore issues is checked. ^^ If Allow contributors or members to modify metric thresholds is checked. ^^^ If Allow contributors or members to suppress failed metrics is checked.

​

Set base (default) permissions for your team

Team Administrators can set base permissions for the team owned repositories.

​

About base permissions

Base permissions apply to all members of a team when accessing any of the team’s repositories. Base permissions do not apply to contributors, or administrators. If someone with admin permissions to a team’s repository, grants a member a higher level of permission for the repository, the higher level of permission overrides the base permission.

​

Setting base permissions

1. Go to the Dashboard
2. Select the team from the account switcher on the top-left.
3. Click on the Settings tab on the left sidebar.
4. On the Settings page, select Access Control next to the billing.
5. In the Member Base Permissions section, select the new Base Permission.

​

Manage an individual’s access to a team repository

People with admin permissions can manage the access of team members and contributors to a team repository.

​

Adding a collaborator

You can add members who are already in your team to the repository, either as a member or a contributor. To add new members, please invite them to your team first. To add a collaborator:

1. Go to the repository dashboard.
2. Go to the Settings tab.
3. Click on the Collaborators tab under Settings.
4. Click Add collaborator.
5. Type their name, or email address in the search box. Once you find the individual, click on their name.
   If you cannot find someone, make sure that they are added to the team.
6. Select the required permission level, and click Confirm and add.

​

Change permission for a member

1. Go to the Repository dashboard.
2. Go to the Settings tab.
3. Click on the Collaborators tab under Settings.
4. Find the individual from the list or use the search bar to find the user. Click on the drop-down menu on the right-side with the user’s permission level.
5. Choose the new permission level, and click Confirm and grant permissions.

​

Sync members from VCS provider

​

About sync

When roles and permissions are changed for any of your team members on your VCS Provider (GitHub, GitLab, or BitBucket), the settings on DeepSource can be updated accordingly by running a Sync.

​

Running sync

1. Go to the Dashboard.
2. Switch to the correct team from the account switcher on the top left corner.
3. Go to Settings from the central navigation bar.
4. On the settings page, click on the Access control tab from the left sidebar.
5. Click on the Sync manually button to sync access settings from GitHub/GitLab/BitBucket.
6. A modal will inform you that this action cannot be undone. If you still want to continue, click Sync access settings.

​

Automatic sync with GitHub

By setting up Automatic Sync (currently only available for GitHub), we can sync access settings for you without any manual intervention. Whenever the permissions, or roles are changed on GitHub, whether repository-wide or organization-wide, we are notified via a webhook, and we update the settings automatically. This means that if a user exists on both GitHub and DeepSource, their access settings will automatically be synced from GitHub in the following events:

• When you remove an organization member on GitHub, they get removed from the DeepSource team as well.
• When you add a new team member on DeepSource that is a member of your organization on GitHub as well, they get added as a repository collaborator on all repositories[1] with the same permission as on GitHub.
• When you add, edit permission, or remove a repository collaborator from a repository on GitHub, the same is replicated on DeepSource.

​

Setting up automatic sync

Team Administrators can set up DeepSource to automatically sync access settings from GitHub.

1. Go to the Dashboard.
2. Switch to the correct team from the account switcher in the top left corner.
3. Go to Settings from the central navigation bar.
4. On the settings page, click on the Access control tab from the left sidebar.
5. Toggle on the switch next to Automatically sync access settings from GitHub.
6. Automatic Sync has been set up.

---

​

title: “Managing people’s access to team with roles”

​

Permission levels for teams

Teams can have administrators, members, and contributors.

• Administrators have complete administrative access to your team. They can manage billing, add or remove team members, and change roles for other members of the team.
• Members have the ability to activate analysis on new repositories. This is the default role.
• Contributors don’t have any team level access. Adding a contributor doesn’t add against a seat on the paid plan.

Team Action	Administrator	Member	Contributor
Change plan (Pricing)
Update number of seats
Update billing details
Manage team members
View Access Control Dashboard
Delete team account
Set granular ignore permissions
Activate analysis on repositories
Sync list of repositories from VCS

​

Change role for a team member

A team administrator can change roles for any team member (except for the team owner).

1. Go to the Dashboard.
2. Go to the account switcher on the top left corner, select the team in which you want to change the role of a member.
3. Go to the My team tab on the left sidebar.
4. Find the member you want to change the role for. Click on the drop down arrow on the right side, and select the new role.
5. Read the message in the modal, and if you want to continue, click Confirm and update.

​

Granular access control permissions

People with admin permissions can manage who is allowed to ignore issues, modify metric thresholds or suppress failed metrics on team owned repositories.

1. Go to the Dashboard, click on the account switcher on the top left corner, select the team in which you want to make the change.
2. Go to Settings in the navigation bar.
3. On the settings page, click on the Access control tab from the left side bar.

​

Issue, metric thresholds, and suppress metric permissions

Team Administrators to grant or revoke permissions to members and contributors for ignoring issues, modifying metric thresholds, and suppressing failed metrics. This helps ensure that the right people have the appropriate level of access to manage issues and metrics effectively. To grant or revoke these permissions, go to the Issue, Metric Thresholds, and Suppress Metric Permissions section. From there, you can select which level of access to grant: member, contributor, or both. You can also choose to revoke access if necessary.