installation_repositories webhook: no "removed" event when switching from "All repositories" to "Only select repositories

[michaelkennethdavid-fw]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Webhooks

Body

When a user changes their GitHub App installation from "All repositories" to "Only select repositories," an installation_repositories event with action added is sent containing the selected repos. However, no removed event is sent for the repositories that lost access.

The reverse (switching from "Select" to "All") correctly sends only the newly gained repos as added, accounting for already-selected repos.

Is this the expected behavior? If so, what's the recommended approach for detecting which repositories lost access during this transition?

[ninjacode911]

Good catch — this is a known gap in how GitHub handles the installation_repositories webhook during that specific transition.

Short answer: Yes, this is the current behavior, and it's arguably a bug or at minimum an undocumented edge case. You won't receive a removed event for repositories that lose
access when switching from "All repositories" to "Only select repositories."

Why it happens:

When an installation is set to "All repositories," GitHub doesn't internally maintain an explicit list of individual repos — it's stored as a flag (essentially
repository_selection: all). When the user switches to "Only select repositories" and picks specific repos, GitHub knows what was selected but doesn't compute the diff of what was
removed because there was no prior explicit list to diff against.

The reverse transition works correctly because GitHub does have an explicit list (the selected repos) and can diff it against the full set.

Recommended workarounds:

1. Listen for the installation event with action: new_permissions_accepted or look at repository_selection field changes. When repository_selection changes from all to selected,
   treat it as a signal to reconcile.
2. Reconcile on transition. When you receive an installation_repositories event with action: added and the installation's repository_selection is selected (previously all):
   - Call the https://docs.github.com/en/rest/apps/installations#list-repositories-accessible-to-the-app-installation endpoint: GET /installation/repositories
   - Compare the response against your stored list of repos
   - Any repo in your stored list that's not in the API response has been effectively removed
3. Periodic sync as a safety net. Poll the installation repositories endpoint on a schedule (e.g., hourly) to catch any drift, not just from this edge case but also from repos
   being deleted, transferred, or archived.

If you want this fixed properly, consider filing this as a bug report through https://support.github.com/contact or in the
https://github.com/orgs/community/discussions/categories/actions-and-packages discussions. The inconsistency between the two directions of the transition is a legitimate issue — if
GitHub can compute the diff in one direction, it should in both.