In reply to Alec Kinnear.

I'm not sure that's true Chris. When the two are tied together directly, it sounds like permissions are less of an issue. Coen Jacobs suggests:

That ‘signal’ you talk about is already there. It’s called webhooks and the entire internet uses it to interact with things happening on GitHub (and plenty other services as well). It’s all there, WordPress.org just doesn’t integrate with them.

Giving permissions to Github itself would be less of an issue. Your code is already there. To some extent with Wordpress.org, although based on Automattic's recent lust for data mining, there is a slight question mark in my mind.