Question

Your team runs a shared GitHub Actions automation bot that opens pull requests, adds comments, and updates status checks across 40 repositories in your organization. Currently the bot authenticates with a personal access token (PAT) belonging to a departing engineer. Security requires that the replacement authentication method: not be tied to any individual user, support fine-grained per-repository permissions, and automatically issue short-lived tokens that expire. Which authentication approach should you adopt?

Accepted Answer

Create a GitHub App with the required repository permissions, install it on the 40 repositories, and have the automation generate short-lived installation access tokens.

Answer

Generate a new classic PAT from a shared service account mailbox and store it in an organization secret.

Answer

Rely on the built-in GITHUB_TOKEN provided to each workflow run for all cross-repository operations.

Answer

Create a fine-grained PAT owned by a team lead and rotate it manually every 90 days.