Re:Deprecating password authentication in GitHub API
by Latty on Sunday April 12, 2020 @01:46PM
(#22849809)
What is really weird is this isn't quite correct, they do have scoped personal access tokens, you just can't make them. If you use GitHub actions, it generates a scoped PAT that only works for that repository for your actions to use.
I use deploy keys rather than a PAT as they can be scoped (single repo and can be read-only), but they are more work and are limited to git actions rather than the whole GitHub API.
The fact they clearly have the internal capability for this makes it incredibly odd they aren't exposing it for users to use, and I agree it'd be a really valuable thing to have.
Re:Deprecating password authentication in GitHub API
by ptoomey3 on Sunday April 12, 2020 @02:06PM
(#22849958)
GitHub Actions tokens are actually based off our newer “GitHub apps” system and not “OAuth apps”. GitHub app tokens support much more granular controls (both in terms of abilities and resources). OAuth doesn’t lend itself to super granular controls since they are scope based (ex. Defining a scope per repository doesn’t really scale). This whole area is something we want to address with personal access tokens in the future.
Re:Deprecating password authentication in GitHub API
by whoisthisfor on Sunday April 12, 2020 @11:38AM
(#22848894)
Adding to this wish list, the ability to rotate a token automatically. I'd like to do something like this with secrets manager, but GitHub's API just doesn't allow it - https://docs.aws.amazon.com/secretsmanager/latest/userguide/...
Re:Deprecating password authentication in GitHub API
by ptoomey3 on Sunday April 12, 2020 @02:01PM
(#22849903)
Think of this deprecation as step one of a multi-step plan/roadmap .
Re:Deprecating password authentication in GitHub API
by treden on Sunday April 12, 2020 @02:24PM
(#22850065)
What is the roadmap for supporting an Action that can push a commit (say a version bump) to a protected branch?
Re:Deprecating password authentication in GitHub API
by ryanmccullagh on Sunday April 12, 2020 @09:50PM
(#22852402)
GitHub Apps has per repo authorizations...
- Repo access is all or nothing. A read-only token is not possible, an 'issues-only' token is not possible.
- Personal access tokens are not scoped to repositories or organizations. So your personal toy project token also allows access to your super-sensitive employer's repository. On top of that, your employer is unable to prevent this, unless you start using Github Enterprise _and_ an SSH CA, which is far from trivial.
It's nice that they drop username/password access, but as long as personal access tokens have such broad permissions, it does not really add any value (you should have been using 2FA anyway).