Understanding the Permissions of Files in the open-seo Repository Root

All root-level files in the every-app/open-seo repository use standard Git permission modes: regular files are 100644 (0644), directories are 040000 (0755), and only docker-entrypoint.sh is executable at 100755 (0755).

The open-seo repository stores its file permissions within Git's object model, meaning every entry in the repository root carries a mode that maps directly to Unix permission bits. When developers clone the repository on Unix-like systems, these permissions are reconstructed automatically, determining who can read, write, or execute each file.

How Git Stores File Permissions

Git tracks file permissions through the mode field in its tree objects. According to the GitHub API documentation for git trees, this field stores the file mode as a string representation of the octal value. The mapping is straightforward:

• Mode 100644 translates to Unix permission rw-r--r-- (0644)
• Mode 100755 translates to Unix permission rwxr-xr-x (0755)
• Mode 040000 indicates a directory with permission rwxr-xr-x (0755)

These values are recorded when files are added to the index and persist across clones.

Complete File Permissions Breakdown for open-seo

The every-app/open-seo repository contains a mix of configuration files, source code, directories, and shell scripts at its root. Here is the complete permission mapping for all top-level entries.

Regular Files (100644 / 0644)

The vast majority of files in the repository root are regular files stored with mode 100644, yielding read-write access for the owner and read-only access for group and others:

• opencode.json — rw-r--r--
• wrangler.jsonc — rw-r--r--
• wrangler.audit.jsonc — rw-r--r--
• worker-configuration.d.ts — rw-r--r--
• vite-plugin-lean-worker-bundle.ts — rw-r--r--
• tsconfig.json — rw-r--r--
• vite.config.ts — rw-r--r--
• vitest.config.ts — rw-r--r--
• skills-lock.json — rw-r--r--
• pnpm-workspace.yaml — rw-r--r--
• pnpm-lock.yaml — rw-r--r--
• compose.yaml — rw-r--r--
• cli-auth.ts — rw-r--r--
• chatgpt-app-submission.json — rw-r--r--
• alchemy.preview-access.run.ts — rw-r--r--
• alchemy.access.ts — rw-r--r--
• README.md — rw-r--r--
• LICENSE — rw-r--r--
• Dockerfile.selfhost — rw-r--r--
• CLAUDE.md — rw-r--r--
• AGENTS.md — rw-r--r--
• .gitignore — rw-r--r--
• .env.preview.example — rw-r--r--
• .env.example — rw-r--r--
• .dockerignore — rw-r--r--

Executable Files (100755 / 0755)

Only one file in the repository root requires execution permissions. The docker-entrypoint.sh shell script is stored with mode 100755, which translates to rwxr-xr-x on Unix systems. This permission allows the script to be executed directly by the Docker container entrypoint mechanism.

Directories (040000 / 0755)

All top-level directories in open-seo are stored with Git mode 040000, which corresponds to standard directory permissions 0755 (rwxr-xr-x):

• web/
• specs/
• scripts/
• runbooks/
• release-notes/
• public/
• badseo/
• .greptile/
• .cursor-plugin/

These permissions allow the owner full control while granting read and execute (traverse) rights to all other users.

Programmatically Checking Repository Permissions

You can verify these permissions programmatically using the GitHub REST API. The following Node.js script fetches the git tree for the every-app/open-seo repository and displays the permission modes for all root-level entries:

import fetch from 'node-fetch';

async function listRootPermissions(owner, repo, ref = 'main') {
  const url = `https://api.github.com/repos/${owner}/${repo}/git/trees/${ref}?recursive=1`;
  const resp = await fetch(url);
  const data = await resp.json();

  const rootEntries = data.tree.filter(e => !e.path.includes('/') && e.type === 'blob');
  console.log('| File | Git mode | Unix permission |');
  console.log('|------|----------|-----------------|');
  for (const e of rootEntries) {
    const perm = e.mode === '100755' ? '0755' : '0644';
    console.log(`| ${e.path} | ${e.mode} | ${perm} |`);
  }
}

listRootPermissions('every-app', 'open-seo');

When executed, this script outputs a permission table matching the manual analysis above. The e.mode property directly reflects the Git object model values documented in the GitHub API reference.

Summary

• Default permission: Most files in the open-seo repository root use mode 100644 (Unix 0644), providing owner read-write and group/others read-only access.
• Single executable: Only docker-entrypoint.sh carries mode 100755 (0755), making it the sole executable file at the repository root.
• Directory handling: All directories including web/, scripts/, and public/ use mode 040000 (0755), standard for traversable directories.
• Git persistence: These permissions are embedded in Git's tree objects and persist across clones and checkouts on Unix filesystems.

Frequently Asked Questions

How do Git file modes translate to Unix permissions?

Git stores file modes in the tree object as octal strings. Mode 100644 maps to rw-r--r-- (0644), 100755 maps to rwxr-xr-x (0755), and directories use 040000 which also results in 0755 permissions. When you clone the every-app/open-seo repository, Git applies these modes to your local filesystem.

Why is docker-entrypoint.sh the only executable file in the repository root?

The docker-entrypoint.sh script requires execution permissions because it serves as the entrypoint for Docker containers. In the every-app/open-seo repository, this is the only shell script located at the root level that needs to run directly, so it is stored with mode 100755 while all other configuration and source files remain at 100644.

Can file permissions change between different versions of the repository?

Yes, file permissions are versioned just like content. If a commit changes a file from 100644 to 100755, that change is recorded in the git history. The open-seo repository currently maintains consistent permissions across its root files, but checking out specific commits could reveal historical permission differences.

How can I check permissions without cloning the repository?

Use the GitHub REST API endpoint for git trees: GET /repos/{owner}/{repo}/git/trees/{ref}. The response includes a mode field for each entry. For the every-app/open-seo repository, this returns values like 100644 for regular files and 100755 for docker-entrypoint.sh, allowing you to audit permissions remotely without downloading the entire repository.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}