docs: clarify GitHub App fetches template sources, OAuth still creates repos

[eon-pulumi-agent]

What

Updates the "GitHub OAuth" prerequisite in Organization templates to reflect that fetching VCS-backed template sources can now go through the installed Pulumi GitHub app, while creating destination repositories still requires the user's OAuth authorization (to attribute the action to the human user).

Why

pulumi-service PR #39792 changed VCS-backed GitHub templates to prefer the org-level GitHub App for reads, falling back to user OAuth, while writes still go through OAuth. The docs previously described OAuth as covering both fetching and creating, which is now stale.

Notes

• Kept the change to a single sentence tweak to avoid growing the page or altering its voice.
• Did not reference the underlying LaunchDarkly flag (39610-template-org-auth), since that's an internal rollout detail rather than user-facing behavior.

---

Created with Eon

[github-actions]

🔍 Triage prose check — possible issues in the diff. Full review is skipped (review:trivial); please double-check before merging.

• [style] content/docs/idp/concepts/organization-templates.md:227 — wordiness: 'in order to' is too wordy.

This is a simplified spelling/grammar/style check in lieu of a full review. Reject false positives at your discretion.

[fnune]

@pulumi-eon I think there is more to this.

More specifically, this ensures that only repositories your GitHub user would normally have access can be used as template sources.

That's not really true, the GitHub app installation enables anyone with access to the Pulumi organization to read templates from sources installed by the organization, regardless of whether the individual GitHub user has access to the repository or not. The assumption is that if a Pulumi organization admin added a template source, it's for the whole Pulumi organization.

Please fix this and find any other outdated reasoning.

[eon-pulumi]

Done

I've addressed the issue raised by @fnune. Summary of changes to content/docs/idp/concepts/organization-templates.md:

1. GitHub OAuth section: Removed the false claim that "only repositories your GitHub user would normally have access can be used as template sources." Replaced it with an accurate description of what OAuth actually governs — it ensures repositories are created using the individual user's own GitHub permissions, rather than the app's broader access.

2. GitHub App section: Added an explicit explanation that since the app is installed and granted access at the organization level, any repository it can reach becomes usable as a template source by every member of the Pulumi organization — regardless of whether that individual's own GitHub user has access. This matches your point that an org admin adding a source is assumed to make it available org-wide.

3. Found and fixed a second instance of the same outdated reasoning: further down in the "Organization settings" section, the doc said "Private repositories work similarly as long as your GitHub user has access to the repository" — the same incorrect assumption. Fixed to reference the GitHub App's org-level access instead.

Verified with node scripts/lint/lint-markdown.js (0 errors across all 1830 site files) and yarn prettier --check on the file — both pass. Changes are pushed to the PR branch.

---

View session

[pulumi-bot]

Your site preview for commit cc15dea is ready! 🎉

http://www-testing-pulumi-docs-origin-pr-20534-cc15dea0.s3-website.us-west-2.amazonaws.com

Changed pages:

• /docs/idp/concepts/organization-templates/