One User, one Owner, closed catalog. Shown once. Unlike github.com, checks may call Checks.
Repository permissions
metadata
Always read on selected repositories
contents
Git and contents REST; read = fetch, write = push
issues
Issues REST
pull_requests
Reviews and merge API
checks
Checks REST (allowed on this forge)
statuses
Commit statuses
actions
Runs, jobs, logs, artifacts, cache, runners
packages
Pull and publish OCI images and artifacts
administration
Collaborators, visibility, webhooks, keys
secrets
Workflow secrets; values are never read back
workflows
Needs contents: write to change .pillion/workflows