6 ms·
Unfortunately this only seems to be available for repos you own yourself and not if an org owns the repo, making it useless in a company context until that is e
by ChymeraXYZ 4y ago
Unfortunately this only seems to be available for repos you own yourself and not if an org owns the repo, making it useless in a company context until that is expanded. Great for personal stuff tho.
- drothlis 4y agoFine-grained access tokens are available on org-owned repos too, but the org has to opt in (for some reason).
- e1g 4y agoThey work, but the organization needs to approve the token (and its scope). As an org admin, I prefer it this way because I can audit what access developers give out to what repositories. The new tokens are still in Beta, so there are some other limitations: for example, GitHub Packages do not support them yet, so you cannot use them in NPM/yarn to get your private packages hosted on GitHub.
- Aeolun 4y agoDoesn't this rather defeat the point? If using a PAT is simpler than using the org token then I'll just use a PAT that has access to every single repository in the org.
- e1g 4y agoGitHub Org admins have the option to block all regular PATs, and only allow fine-grained tokens that they pre-approve. This block is “off” by default, but I expect the best practice soon will be to enforce this rule.
- Aeolun 4y agoOh, aside from the pre-approval, that would be really nice. I need stuff scoped to the org that is not necessarily connected to my personal account (and all it’s repositories).