why does use of JSPM_GITHUB_AUTH_TOKEN require public_repo?

[tamird]

According to https://developer.github.com/v3/oauth/#scopes, public_repo

Grants read/write access to code, commit statuses, collaborators, and deployment statuses for public repositories and organizations. Also required for starring public repositories.

This seems excessive. Why isn't public access sufficient?

[tamird]

Looks like this is because of JSPM attempting to support username/password authentication the same way it supports API tokens. Would you consider a PR that changes this behaviour to API token only?

[guybedford]

I'm not sure what change we can do to alter this?

[guybedford]

(jspm 0.17 may need less access though)

[tamird]

It's not a matter of access - it's not like jspm needs access to my public repos.

This is just a result of how the URL is being crafted. If you used https://developer.github.com/v3/#authentication (https://api.github.com/?access_token=OAUTH-TOKEN) you could just provide the oauth token (you wouldn't need the username at all) and no access would be needed.

[guybedford]

Ahh, well that would make life easier. PR very welcome!