It there any way for Dependabot to create its branches in a fork, then make pull requests to the main repository? It would be nice if write permissions didn’t have to be granted to the app.
Frustratingly, there’s no easy way for me to get Dependabot to do that 
. I’m going to speak to GitHub about it next week when I’m in San Fran, but at the moment:
- GitHub App have to ask for the same permissions from all their installs
- As a result, if Dependabot wants to be able to write branches for private repos (because it would be odd to fork them) then it needs to ask for write permission from all its users
- That sucks and it’s obvious how it could be improved, but it’s out of my control
- The only workaround from Dependabot’s side would be to create an entire separate app, like Dependabot-Fork, that used different permissions, but I think the scope for complexity and confusion there is too high
I’m really frustrated about the above, because I can totally see how a “fork and PR” flow would be more intuitive for open source projects, and I don’t like Dependabot having more permissions than it strictly needs. It will only ever push to branches namespaced under dependabot, and I say as much in our Terms of Service, but it’s still not ideal. On the plus side, there’s no way that Dependabot can push to protected branches (like discourse’s master).