Tokens and permissions

The exact GitHub scope Caretaker requires, and what it's used for.

Required scope

A classic GitHub personal access token with the repo scope — the single checkbox covering full control of the repository. Fine-grained tokens aren't used, since they require selecting Contents, Pull requests, Actions, and Metadata permissions individually per repository.

https://github.com/settings/tokens/new?description=Caretaker&scopes=repo

That link opens GitHub's token creation form with the description and repo scope already filled in.

What it's used for

The same token clones the repository, pushes the fix branch, opens the pull request, and — only after your explicit approval — merges it. It's encrypted at rest and never sent to your browser.

What Caretaker never does

Caretaker never uses administrator overrides to bypass branch protection, and never approves its own pull requests.