sheriff

What it does

Sheriff is a bot that, when deployed and configured, controls permissions across GitHub, Slack, Heroku and GSuite using a combination of webhooks and a YAML configuration file. Slack and GSuite plugins are optional and disabled by default. It posts to a designated Slack channel every time it updates a permission setting and every time it detects potentially suspect actions, including new deploy keys with write access, tag deletion, or release branch deletion. The README positions it for organizations with many repositories or members that want to stay secure and transparent.

Core components

There are three core components that all must be configured. The webhook is a server started with npm start and registered as an organization wide GitHub webhook set to send everything. The GitHub App needs administration write, contents read and metadata read scopes at the org level and members write at the repo level, with a downloaded private key passed through a utility to match what Octokit expects. The cron job runs the permissions controller every ten minutes and supports a dry run unless the --do-it-for-real-this-time flag is passed.

Deployment and license

The project recommends deploying as a Heroku app, which is how the Electron team runs it, using the Heroku Scheduler addon for the cron job, though other strategies are possible. A Slack app with incoming webhooks and specific OAuth scopes sends realtime messages about actions taken. Configuration is via environment variables plus a permissions.yaml reference. Sheriff is built by the Electron team and is licensed MIT.

Editorial conclusion

Sheriff is MIT licensed and reported one hundred fifty two stars at indexing, with the README recommending Heroku and its Scheduler addon for the recurring permissions check.