Give a contractor Write on only the repositories they work in, and Read or Triage everywhere else. Write can push, merge and manage Actions secrets, so treat it as a real grant. Keep Maintain and Admin for employees, since Admin controls branch protection, deploy keys, visibility and deletion.
The five roles in plain terms
| Role | Intended for | Notable limits |
|---|---|---|
| Read | Non-code contributors who view or discuss | No pushing, no secrets |
| Triage | Managing issues and pull requests without write access | Cannot push or merge |
| Write | People who actively push | Cannot change repository settings |
| Maintain | Project managers who avoid destructive actions | Cannot manage branch protection or rulesets, cannot delete the repo |
| Admin | Full control | Everything, including visibility and deletion |
Those descriptions come from GitHub's repository roles page.
The detail people miss about Write
Write sounds modest. According to GitHub's role table, it can also create, update and delete Actions secrets and variables, run workflows, edit releases, and dismiss Dependabot alerts. A contractor with Write on a repository can therefore reach every secret that repository's workflows use.
That changes how you design access. If a repository holds production deploy secrets, a Write grant is closer to an operations grant. Move deploy credentials into environments with required reviewers, or hold them at a level a Write user cannot read.
A simple decision rule
- Does the contractor need to push code? If not, use Read or Triage.
- Do they need to push to one or two repos? Grant Write on those repos, through a team named for the engagement.
- Do any of those repos hold secrets beyond staging? Move or scope them first.
- Set an end date in your tracker and put a reminder on the calendar.
- Never give Maintain or Admin to a contractor for convenience. If a task needs it, have an employee do the step.
Grant through a team, not individual repo invitations. Removal then becomes one action, and the team page doubles as the access list during reviews.
Pair the role with branch rules
Roles say who can push. Branch protection says what must happen before code lands. A contractor with Write should still need a review from a staff member on the default branch. Remember that Admin can merge on protected branches without approving reviews, which is another reason to keep that role narrow.
Where Safeguard fits
Safeguard scans dependencies and builds an SBOM, and its policies and gates can block a pull request that adds a known-vulnerable package. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Can Triage merge pull requests?
No. Triage can manage issues and pull requests, request reviews and apply labels, but cannot push or merge.
Should contractors be outside collaborators?
That is a reasonable pattern for single repository access. Whichever you pick, give an end date and review it.
Sources
Last reviewed: 19 October 2026.
