Make drawio GitHub Integration a GitHub App instead of an OAuth App

• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for a feature request that matches the one I want to file, without success.

Is your feature request related to a problem? Please describe.

Somewhat, it’s related to a problem with the permission levels of GitHub OAuth Apps.

I am trying to get companies to adopt using drawio across all of the repos in their org. However, because it integrates as an OAuth App and not a GitHub App, there are less controls / transparency around the scopes/permissions given to the app so companies are hesitant to adopt it. Also, GitHub Apps can be posted on the Marketplace for discoverability which is another bonus.

According to “About apps”:

GitHub Apps are the officially recommended way to integrate with GitHub because they offer much more granular permissions to access data…

Describe the solution you’d like

1. Register drawio as a GitHub App instead of an OAuth app
2. Scopes needed:
   1. Contents (Read/Write for commits)
   2. Metadata (Read only, mandatory)
3. Callback URL: https://app.diagrams.net/github2
4. No need for any webhooks
5. Update github client ID and secret used in the code to the new ones
6. Remove scopes from GitHubClient.js

-/**
- * OAuth scope.
- */
-GitHubClient.prototype.scope = 'repo';
...
    var win = window.open(this.baseHostUrl + '/login/oauth/authorize?client_id=' +
-	    this.clientId + '&scope=' + this.scope + 
+	    this.clientId + 
	    '&state=' + encodeURIComponent('cId=' + this.clientId + //To identify which app/domain is used
		    '&domain=' + window.location.hostname + '&token=' + state), 'ghauth');

1. Profit (not really) 🚀

If you’d like to see an example, I forked the repo and published the app to Azure to prove it out. I also did this in case you are not interested, so I can still use drawio in these company repos 😄

Describe alternatives you’ve considered

1. Getting a security review of the code for the OAuth App
2. Not using drawio but using something else (which would make me sad)

Additional context Add any other context or screenshots about the feature request here.

I found some semi-related issues:

1. https://github.com/jgraph/drawio/issues/1117

[davidjgraph]

We’ll take a look. We did submit as a Github app just after they were launched and Github rejected it saying it wasn’t the kind of integration they are looking for.

[davidjgraph]

Yeah, we’re working on the changes to make the app the default. In the meantime, we need to try to get as many people as possible to install the app before the switch.