Quick Notes94 words
GitHub authentication — quick notes
GitHub authentication — quick notes
| Mechanism | Identity | Lifetime | Preference |
|---|---|---|---|
GITHUB_TOKEN | The workflow run | Ends with the job | First choice |
| GitHub App | The app installation | Short-lived install token | When GITHUB_TOKEN is insufficient |
| PAT | A person | Until expiry/revocation | Last resort |
- Declare
permissions:to narrowGITHUB_TOKEN— defaults are broader than needed. - Cross-repository work → GitHub App, not a PAT.
Trap: a PAT ties automation to an individual and breaks when they leave.