Allow any GH user to push datasets

[matamadio]

I didn't notice before, but it seems you need WRITE access in order to push new datasets, i.e. commits.
This is not optimal - we don't want to manually enable any individual that wants to push a dataset. Anyone with a GH account should be able to commit.
Below suggestions for alternatives:

Best Option: Fork + PR Workflow

Users authenticate with their own GitHub account:
Uses their credentials (OAuth)
Commits to their fork
Opens PR to your repository
You review and merge
✅ Secure, standard, scalable

Alternative: GitHub App with Backend

Create a GitHub App (not embedding tokens)
Users authenticate through GitHub OAuth
Backend service (with server-side token) does the commit
✅ Secure, but requires hosting a backend

Simplest (Limited): Shared Service Account

Create a dedicated "bot" GitHub account
Give it write access to your repo
Share those credentials (still not ideal, but isolated)
⚠️ Users could still abuse it

@lydiascarf I'd take your advices here for the smoothest, least impactful approach.

[matamadio]

• Currently testing on first option: Fork + PR Workflow
• If that doesn't succeed, we can consider applying a CMS such as https://pagescms.org, that will embed/recreate the MDE. By this way, users will not need a GH account, just an email invite. However this implementation will take time and will be done with @lydiascarf help in June.

[matamadio]

Alright, first option seems to be working well.

• Users authenticate with Personal Access Token (public_repo scope only)
• Editor automatically creates fork if needed
• Commits dataset to user's fork
• Opens PR from username:branch → GFDRR/rdl-jkan:rdl-1.0
• Repository admins review and merge > See example PR

@lydiascarf can we already create the rdl-1.0 branch? So we can set up the dataset PRs properly.

[lydiascarf]

@matamadio sure, I see no reason to wait on creating rdl-1.0!