GitHub App permissions

When you install the Peeps GitHub App, GitHub shows a list of permissions. This page explains each one: what Peeps does with it, when, and how common it is among other GitHub Apps for coding, code review and testing. Peeps asks for everything it needs at install time. GitHub makes every installation re-approve an app that adds a permission later, so asking once means Peeps doesn’t interrupt your organization’s owners each time it gains a capability.

At a glance

Permission	Access	Peeps uses it to
Contents	Read and write	Read your tests, and push fixes and new tests to `peeps/*` branches
Pull requests	Read and write	Open a pull request for every fix and new test, and report results on yours
Issues	Read and write	Answer `/peeps` commands, and file bugs that failing tests uncover
Checks	Read and write	Post Peeps results as checks on your pull requests
Commit statuses	Read and write	Read results from CI outside GitHub Actions, and post Peeps results where your rules expect a status
Actions	Read and write	Start Peeps runs in your CI, cancel superseded ones, and read logs for failure analysis
Workflows	Read and write	Add and update the Peeps workflow file through a pull request
Variables	Read and write	Keep the Peeps workflow’s settings in Actions variables, so you don’t copy them by hand
Deployments	Read and write	Test each deploy as it lands, and hold production deploys until Peeps passes
Environments	Read	Find each environment’s URL, so runs target the right one
Merge queues	Read	Run Peeps as a check in your merge queue
Webhooks	Read and write	Set up and rotate the deploy trigger that starts runs
Metadata	Read	Required by GitHub for every app
Members	Read	Route failures to the owning team, and limit who can run `/peeps` commands
Email addresses	Read	Match your GitHub account to your Peeps account when you sign in with GitHub

What other tools ask for

We read the public permission lists of 37 GitHub Apps in four categories. Each column shows how many apps in that category request the permission at the same access level as Peeps, or higher.

Permission	Coding agents (9)	AI code review (9)	AI testing (7)	Testing and CI tools (12)
Contents (write)	9	7	4	2
Pull requests (write)	9	9	7	9
Issues (write)	9	9	5	5
Checks (write)	6	6	6	7
Commit statuses (write)	3	5	2	9
Actions (write)	7	2	2	3
Workflows (write)	9	4	2	1
Metadata (read)	9	9	7	12
Members (read)	6	8	0	7
Email addresses (read)	6	5	2	6
Deployments (write)	0	0	1	1
Merge queues (read)	1	1	1	0
Webhooks (write)	1	0	1	0
Environments (read)	1	0	0	0
Variables (write)	0	0	0	0
Secrets	0	0	0	0

The last six rows are less common because few tools test deploys, run in merge queues or set up CI for you. Each is explained below.

Counts come from GitHub’s public app records for each tool, read in September 2026. They show what each app requests, which can differ from what a given installation has accepted.

Your code and pull requests

Permission	What Peeps does with it	When
Contents	Reads your test files, page objects and config at a commit, so Peeps sees your suite as it is. Pushes each fix or new test to its own `peeps/*` branch.	Reads on every push to a branch Peeps tracks. Writes when a fix or a new test is ready, or when you ask Peeps to push a change.
Pull requests	Opens a pull request for each fix or new test, with the evidence behind it. Comments run results on your pull requests.	When Peeps has a change for you to review, or finishes a run on your branch.
Issues	Reacts to and answers `/peeps` comments on issues and pull requests. Files an issue when a test fails because of a bug in your app.	When someone writes a `/peeps` comment, or a failure is traced to your app.
Checks	Posts runs as checks such as Peeps / fix verification, so results sit next to your other CI results.	On every Peeps run tied to a commit.
Commit statuses	Reads the statuses that Jenkins, CircleCI, Buildkite and some preview hosts post, so Peeps knows when your build is green and where a preview lives. Posts a Peeps status for branch rules that require one.	When a commit Peeps tracks gets a new status, and when a Peeps run finishes.

Your CI

Permission	What Peeps does with it	When
Actions	Starts the Peeps workflow in your own CI, so tests run on your runners with your secrets. Cancels runs a newer commit has replaced. Reads job logs and artifacts to analyze failures.	When you or a trigger starts a run, and after every failed run.
Workflows	Adds `.github/workflows/peeps.yml` through a pull request when you set up a repository, and updates it when Peeps changes how runs work. GitHub requires this permission to change any file in `.github/workflows`, even on a branch.	At setup, and when the workflow needs an update. Every change is a pull request.
Variables	Stores the Peeps workflow’s settings, such as the project, test root and base URLs, as Actions variables that the workflow reads.	At setup, and when you change those settings in Peeps.
Merge queues	Runs Peeps as a check on each merge queue entry, so a change is tested against everything ahead of it.	When a pull request enters a merge queue that requires Peeps.

Peeps does not request Secrets. Your CI keeps its own secrets, and Peeps runs authenticate with GitHub’s OIDC tokens, so no Peeps key is ever stored in your repository.

Your deploys

Permission	What Peeps does with it	When
Deployments	Starts a run when a preview or staging deploy finishes. Acts as a deployment protection rule, so a production deploy waits until Peeps passes. Marks each deployment with its Peeps result.	On every deploy to an environment you connect to Peeps.
Environments	Reads each environment’s URL and protection settings, so runs target the right environment.	When you connect an environment and at the start of each run.
Webhooks	Creates the webhook that tells Peeps a deploy finished, rotates its secret, and removes it when you disconnect.	When you turn on deploy triggers, rotate them or disconnect.

Your people

Permission	What Peeps does with it	When
Members	Reads organization members and teams, so Peeps can route a failure to the team that owns the code and limit `/peeps` commands to the people you choose.	When a failure needs an owner, and on each `/peeps` command.
Email addresses	Reads the email on your GitHub account, so signing in with GitHub connects you to the right Peeps account. This is granted by each person when they sign in, not by the installation.	When you sign in to Peeps with GitHub.

What Peeps does not request

Secrets. Peeps can’t read, create or overwrite your repository or organization secrets.
Administration. Peeps can’t change repository settings, branch protection or rulesets.
Organization write. Peeps can’t add or remove members, teams or roles.
Security alerts. Peeps doesn’t read code scanning, secret scanning or Dependabot alerts.

To limit Peeps to specific repositories, choose Only select repositories when you install the app.

Questions about a permission? Get in touch.

​At a glance

​What other tools ask for

​Your code and pull requests

​Your CI

​Your deploys

​Your people

​What Peeps does not request

At a glance

What other tools ask for

Your code and pull requests

Your CI

Your deploys

Your people

What Peeps does not request