I’m not sure how we would determine in advance whether we’re able to use the lesser scopes. Perhaps this would require a clunky double-auth where you first connect your account and give basic permissions, then we check your repos, then we ask for extra permissions as required. That wouldn’t be a very nice experience, but it is doable I think.

I’m not sure exactly how you’re tracking GitHub user events, but the entirety of my commit history for all my public repos is available via the GitHub API with the anonymous (No scope) permissions. I’m aware that GitHub’s scoping leaves much to be desired, but I auth that allows full read/write to all my repos is obviously a no-go. Thanks

Totally understand that you don’t want to give access, not a problem. If there’s no auth required then that does make this a little easier perhaps — thanks!