# Windmill GitHub App: why the new permissions

Windmill is moving the git sync work it used to ask you to run as a GitHub Action
into the app itself, so two-way sync works out of the box. That needs a few more
permissions. They are all scoped to the repositories you install the app on, and
they do not grant any new access to your code beyond what the app already has.

| Permission (Read and write) | What it enables |
| --- | --- |
| Repository webhooks | Create a webhook so pushes deploy to your Windmill workspace instantly, instead of polling on a timer. |
| Pull requests | Open the promotion / fork pull requests for you, replacing the `gh pr create` GitHub Action. |
| Checks | Post a "Windmill diff" check on a pull request showing what it would change in the workspace. |

Windmill creates a per-repository webhook on each connected repo and sets its
events (`push`, plus `pull_request` for checks) itself, so you do not need to
change the app-level "Subscribe to events" list. The events are only available
because the permissions above are granted.

Approving is safe and reversible. Existing sync keeps working unchanged while the
update is pending, and Windmill falls back to polling for any repository where a
permission has not been granted yet.