Prevent students from putting non-assignment repos in Organization

I just learned that students can add their own non-Classroom repos to my Classroom organizations.

Here is what I think is happening: Each GitHub classroom is associated with a GitHub organization. When a student accepts a GitHub classroom assignment, he becomes a “member” of that organization. Members are, by default, allowed to create private repositories.

Therefore, once a student has created a repository through Classroom, he can then add any repo he likes to the organization.

I assume that the organization’s “repository creation” setting must be kept at “private” (and that unchecking this option would prevent the system from creating new Classroom-based repositories).

Is that correct? Is there a way to allow students to accept assignments, but prevent them from adding other repositories?

(On a related note, is there a way to remove students from an organization at the end of the semester? Removing their repos doesn’t seem to revoke their membership.)

2 Likes

Hi @kurmasz

Nope, the student becomes a collaborator (or admin, depending on your assignment setting) of that specific repo, not an org member.

Therefore, once a student has created a repository through Classroom, he can then add any repo he likes to the organization.

More in general, you can set up the basic privileges of org members.
Check out: Restricting repository creation in your organization - GitHub Docs.


That said, the student might have been able to create a repository inside your organization because he/she has been invited somehow.

1 Like

We’ve noticed that a student does indeed become a member in de organisation when the assignment is a group assignment.
Individual assignments do not trigger this.

1 Like

Ah, correct; good catch. I don’t use group assignments, indeed.

Well, teams work only with org members and not outside collaborators. That must be why students need to become org members to team up.

2 Likes

Most of my assignments are group assignments.

Am I correct that if I “downgrade” students from members to collaborators, then they will no longer have access to the group assignments?

2 Likes

You should visit the Access page of the repository (https://github.com/orgname/reponame/settings/access) to see if the access is guaranteed per team or per user.

If it’s per team (as it’s reasonable to expect), then by converting the student into a collaborator, he/she will stop being a team member, thus losing access.

However, as a partial remedy, you can tune up the permissions for creating new repos for all org members.
See this resource:

1 Like

There is no such url. Did you mean https://github.com/orgname/reponame/settings/member_privileges?

If I restrict repo creation to owners only (no member), will GitHub classroom still be able to create repos for students when they click on the assignment link? (In other words, on whose authority is the repo created? Mine or the student’s?)

@kurmasz Group member students will continue to have access if they have already accepted i.e. the privilege change is done after acceptance.

Also, setting the org settings to not allow users to create repos would prevent students from putting non-assignment repos in Organization and they be able to still accept assignments and create assignment repos.

Please share if this resolves the issue for you.

1 Like

Yep, sorry, you’re right: that is the correct URL :+1:t2:

Yes, as repos are created by the GitHub Classroom App, to which you should have granted access already. In the past, repos were created using one of the owner’s credentials (picked randomly), instead.

Then, I would assume that the access to the repo is implemented per user rather than per team for group assignments. Outside collaborators cannot be members of teams, as far as I know.

1 Like
© 2017 GitHub, Inc.
with by
GitHub Education