GitHub Token - Restrict Access

Question

I am using GitHub token as the credential for others people. Can make the token only allows the user to clone and pull, but NOT push or delete.

Lumisterol

Answer 1

GitHub tokens do not provide access to a repository, it is mainly to provide authentication of the user. Clone or Pull or push are mainly GitHub repository functions and you can manage specific access using Setting --> Contributors for the repository. Select the "Read" option in the contributors option of Repository Settings.

Scag

Answer 2

GitHub tokens can now (Oct. 2022) provide access to a repository, if you set GitHub App permissions

That way, even a contributor might not have all write access (ie might not trigger a GitHub action, change protection, patch a commit, push a commit, ...

You now can define a much more granular access through those new fine-grained personal access token.

Exasperate