actions / actions/actions-runner-controller

Better Documentation for Fine-grained Personal Access Tokens

Open
#2,361 3 comments 18 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement needs triage
Dominant language
Go
Stars
6.5k
Forks
1.5k
Avg merge
2d 2h
Merged PRs (30d)
27

Description

What would you like added?

GitHub now supports fine-grained PAT. A guide that covers how to configure a token with LPA (least privileged access) for common scenarios would be a helpful guide.

A clear and concise description of what you want to happen.
Documentation that leverages the new fine-grained PAT, and provides sets of permissions one may use to create a fine-grained PAT for common scenarios in which one would use ARC.

Why is this needed?

Having documentation that tells users to use PAT that provide large scale permissions is not the best security approach. It is a common practice to generate tokens with LPA permissions.

A clear and concise description of any alternative solutions or features you've considered.
I am manually building my own sets of permissions at the moment for the various scenarios we use ARC in.

Additional context

Add any other context or screenshots about the feature request here.
Fine-grained PAT now allows tokens for specific repositories, with more fine grained permission controls.
image

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No file or test is named in the issue. Start by locating the current ARC documentation for PAT or authentication and compare its recommendations with GitHub's fine-grained PAT permissions. Done means a guide lists least-privilege permission sets for common ARC scenarios.

Written by the indexing model from the issue text.

Assessment

Tech stack
github, github-actions, kubernetes
Domain
authentication, authorization, documentation, security
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.