Comment by Androider | Hacker News Reader

Comment by Androider | Hacker News Reader

Hopefully they'll enhance the other authentication methods. I was quite surprised how complicated yet insecure the GitHub Actions and personal access token mechanisms are just last week.

GitHub Actions tokens are scoped to the single repo they operate in, so for anything that you need covering any cross-repository or org access the official docs immediately tell you to just use a PAT instead. But PATs have no repository scoping whatsoever, it's all or nothing. So although both PATs and GHA Tokens have these complex scope requests, it's completely missing the most basic use cases in my opinion, like creating a PR in repo X, allow installing a package from GitHub Packages in repo Y, check out code from repo Z etc. You either go full mono-repo for everything, or you use PATs for everything with no repository boundaries at all, yikes.

Yeah .. it's not great. Creating a machine user is really the only way to do it right now :(.

And they'll charge you the full seat price for it :/

GitLab now has project access tokens for that.

If you have a "project" not a "user". If I'd known this in the past I would have just created a "kevincox" project and a "kevincox-u" user.

The scoping of pat currently are terrible. If I want a read only access token, the user needs to be read only, if I went write, user needs write permissions. This means I need 2 users

You could always use "Deploy keys" which are per-repo read-only SSH keys. You could set up multiple repos with the same deploy key and use the private key in GitHub Actions secrets.

This won't work as a deploy key can only be used in one repo.

The same key can be copied over to any number of repos you want, unless I'm missing something from the GitHub docs

The current suggested solution is to create a new user just for that repo and create a PAT in that user. So the PAT will only have access to that repo.

Reply on news.ycombinator.com