"Act on your behalf" permission is unreasonably alarming

[JeremyRand]

Trying to log in to Cirrus yields a GitHub prompt asking me to grant Cirrus permission to "Act on your behalf", which is horrifyingly alarming. DuckDuckGoing for this phrase yielded a few GitHub Support Community threads in which the GitHub staff claim that this doesn't mean what anyone fluent in English would infer it to mean (i.e. it supposedly doesn't actually mean that Cirrus gains the ability to do arbitrary things on GitHub as me), but also claim that the wording is "not considered a bug" (your guess is as good as mine why they think deliberately confusing people is a feature and not a bug).

Alas, since GitHub has no intention of fixing this, it would be useful to investigate other options to avoid this warning. As of 2020 Aug 20, GitHub staff claimed that this antifeature only affects GitHub App authentication and that OAuth is unaffected. I have no clue if this is accurate, but seems worth looking into. At the very least, explaining on your website what the prompt actually means would be a mild improvement.

(Sorry to bother you with what is apparently a problem on GitHub's end, but alas it's probably scaring away more of your users than just me, so seems like something you should be aware of even though it's probably not your fault.)

[fkorotkov]

@JeremyRand thank you for letting us know!. I'll work on clarifying it in the docs and maybe talk to GH stuff though developer channels.

We try to minimize the amount of permissions required. Cirrus requires write access only to "Commit statuses" and "Checks" for reporting back builds statuses, "Content references" (only for cirrus-ci.com domain).

[fkorotkov]

Updating the installation guide in #757

[ariccio]

I don't even use Cirrus, but this is now one of the top results in google for github "Act on your behalf". They seriously intend it? What a strange decision. Thanks for providing links to their decisions, there's no way in hell I would've figured that out.

[akostadinov]

These discussion links are broken :/
There is a new discussion but without dev feedback sod far: https://github.com/orgs/community/discussions/37117

I guess everybody is welcome to vote for it.

[fkorotkov]

@akostadinov thank you for linking the discussion! Just upvoted!