Organizations live
An organization is a shared home for repositories, secrets and members. Its owners decide what members may do with every repository, so you do not invite people one repository at a time.
Create one
Choose New organization from the + New menu in the header. Give it a handle, a name and an optional description. You become its owner.
gitstalk.dev/acme is a person or an organization, never both. It stays
for the life of the organization: it is in every clone URL.
Roles and base permission
| Role | May |
|---|---|
| owner | Everything, including other owners and deleting the organization. The last owner cannot leave. |
| admin | Settings, secrets, members and every repository, as its owner. Cannot grant owner. |
| member | The base permission on every repository. Creates repositories unless only admins may. |
| viewer | The base permission, at most read. |
The base permission is what members get on every repository without being invited to it: none (the default), read or write. With none, members and viewers reach only the repositories they are invited to, plus the organization's internal and public ones. Owners and admins reach every repository.
Who can do what
| Who | Private | Internal | Public |
|---|---|---|---|
| Owner, admin | Owner | Owner | Owner |
| Member or viewer, base none (default) | Not found | Read | Read |
| Member, base read or write | Read or write | Read or write | Read or write |
| Viewer, base read or write | Read | Read | Read |
| Outside the organization | Not found | Not found | Read |
Not found is a real 404: the repository looks as if it does not exist. A collaborator role on one repository adds to this, and the stronger one counts. The same rule decides access over HTTPS, SSH, MCP and the web.
Organization settings
Open an organization from the menu under your avatar, then Settings. Each section is its own page with its own Save. Owners and admins see all six; other members see Secrets and variables, and Danger zone to leave.
| Section | What it does | Who sees it |
|---|---|---|
| General | Name, description and the icon (PNG, JPEG, WebP or GIF up to 2 MB, cropped square; without one you get the handle's first letters). See the upload rules. | owner, admin |
| Members and invitations | Invite by handle with a role (member by default; only owners grant owner), change roles, remove people, cancel invitations. Invitees accept on their Home. | owner, admin |
| Repository defaults | The base permission, who may create repositories, and whether new ones start private or public. | owner, admin |
| Secrets and variables | Actions secrets and variables shared across the organization's repositories. See Secrets and variables. | everyone in the organization; owners and admins manage |
| Audit log | The last 100 events, newest first, times in UTC. | owner, admin |
| Danger zone | Leave the organization (everyone; the last owner must name another owner first). Owners can delete it once it owns no repositories, by typing its handle. | everyone; delete for owners |
What the audit log records
The log records: the organization created and its settings changed; members invited, invitations cancelled, accepted or declined; roles changed; members removed or who left; repositories created in it; and repositories moved in or out.
Repositories in an organization
- Create one from New repository by choosing the organization as the owner. Where you may create depends on the organization's rule above.
- Move one in or out from the repository's Settings, Danger zone (transfer). You can move your own repository to an organization where you are an owner or admin, or an organization's repository to yourself or another organization you administer. History, beans, collaborators and deploy tokens move with it, and the old address keeps working. See Renamed and moved.
- An internal repository moved to a person becomes private, because only organizations have internal repositories. Moved to another organization it stays internal to that one.
Organization secrets
Each organization secret or variable reaches one of three sets of repositories: all, private only (which means not public, so internal ones too, as on GitHub), or selected repositories you pick. A repository's own entry of the same name wins over the organization's. Values are typed once and never shown again. Details, including the pre-land switch, are on Secrets and variables.
Not yet
- Teams planned
- Email invitations planned: Gitstalk sends no mail yet, so invite by handle.
- Changing an organization's handle planned