Best practices for giving external pipelines/tools access to GitHub

Question

What are the best practices for giving build/test pipelines and tools access to GitHub? Do you just have a single user within the organization provide PATs for each pipeline/tool, or is there a better way to handle it?

For example, say we want to build our product using a Jenkins pipeline. Should we just have a user create a PAT for Jenkins to use to access the GitHub repository? Is there a way for an org to create a PAT, so it can be managed/owned by the org itself?

Answer 1

Fine-Grained Personal Access Tokens

GitHub doesn't currently access-tokens divorced of the user account. The best method to do this is a fine-grained PAT. You can read the tutorial on how to create a fine-grained access token, but it's pretty easy to figure it out, just follow the prompts here,

• https://github.com/settings/personal-access-tokens/new

Alternatively, if you can make the pipeline triggered by the CI, you can use the CI-provided GITHUB_TOKEN