drone/drone — pull request #260 by aadavids (2014-04-11 20:18:48+00:00)
Title: Github organization repo setup with limited permissions

# Two Token Builds with Drone

## The Problem
The current method of setting up a Github repo with Drone requires you to give "repo"-access (read and write) of your github repository to drone. This is a far more expansive set of permissions than is needed.

Github's permission scopes are not fine-grained en to allow an application:
* read only access to repo code; and
* read/write access to repo hooks and commit statuses.

This PR employs the principle of least privileges. It uses two tokens and only works for "organization" account:

* one token has read only access to the repo (token 1);
* the other has write access to commit statuses and repository hooks (token 2).

## Setup is as follows:
1. On github, create a "machine user" and add it as a read-only contributor to your organization.
2. On that user's account, go to Settings -> Applications and create a personal access token with *repo, user* permissions. (token 1)
3. On your own Github account (or an account that owns the organization), go to Settings -> Applications and create a personal access token with *write:repo_hook, repo:status* permissions (token 2).

## New UI Section
You enter the two tokens, along with the organization and repo name in the new "Github with limited permissions" UI section:

![snap](https://cloud.githubusercontent.com/assets/819887/2683801/a45c43a2-c1ae-11e3-9266-010b0f7e3b9e.png)

The main code changes are mostly isolated and include the addition of new github repo handler functions, a new database field to support the second token for writing the status and hooks, and the updates to the page templates for the UI.