3 ms·
The issue is that once you add a PAT, you’ve imbued the build with your permissions. You can bound which permissions by call type (so, for example, you can make
by akerl_ 5y ago
The issue is that once you add a PAT, you’ve imbued the build with your permissions. You can bound which permissions by call type (so, for example, you can make a token that can’t modify your profile info), but you can’t bound it by repository. So if you need the build to trigger write actions on one repo, now it has them for all repos.
- simonw 5y agoAgreed, this is an infuriating limitation of PATs - I would desperately like to be able to create a PAT with much more finely grained permissions - can only trigger this single REST API for this specific repo for example. There's a brilliant trick for doing that described here but it's a lot of work to setup: https://blog.thea.codes/building-a-stateless-api-proxy/ https://blog.thea.codes/building-a-stateless-api-proxy/ You can also create a brand new GitHub user account, grant it access to just a single repository and then create a PAT for that user account - annoying but it does at least let you scope down the permissions a bit.