Distinguish Between GitHub Apps, GITHUB_TOKEN, and Personal Access Tokens
Three main methods authenticate workflows between Azure Pipelines and GitHub. GitHub Apps are registered applications that integrate with GitHub using OAuth and have configurable permissions. The GITHUB_TOKEN is a short-lived, automatic token generated for each GitHub Actions workflow run, with permissions scoped to that specific workflow. Personal access tokens (PATs) are manually created by a user, grant access based on the user's permissions, and must be managed for long-term use. Choosing between them depends on whether you need a dedicated app integration, a temporary workflow token, or a persistent user credential.
Assign Minimal Scopes and Permissions
For each authentication method, you must assign the least privilege necessary. For GitHub Apps, you select only the repository, organization, or project permissions the app requires to function. The GITHUB_TOKEN's permissions are automatically limited to the repository where the workflow runs, but you can further restrict its scopes within the workflow definition. When creating a personal access token, you explicitly choose scopes like repo or workflow, and you should select only the scopes needed for the pipeline's tasks to follow the security principle of least privilege.
Integrate the Chosen Authentication Flow into Azure DevOps Service Connections
To use these GitHub credentials in Azure Pipelines, you create a service connection in Azure DevOps. For a GitHub App or a personal access token, you provide the authentication details to establish a connection from Azure DevOps to your GitHub repositories. The service connection securely stores a reference to the credential, allowing your pipelines to authenticate with GitHub for tasks like checking out code or posting status updates. The choice of credential type dictates how the service connection is configured and managed.
Implement Secure Storage, Automated Rotation, and Auditing
Sensitive credentials like personal access tokens must be stored securely, not in plain text within pipelines. Azure Key Vault is a service that provides secure secret storage; you can store a PAT there and reference it from your pipeline. For long-lived tokens, you should implement automated rotation, using scripts or scheduled tasks to generate new tokens and update the service connection or Key Vault before the old ones expire. Regular auditing of these authentication methods, checking who created tokens and what permissions they have, is essential for maintaining security and compliance with organizational policies.
StudyCerts
StudyCerts