Do you use a personal access token to interact with the LLVM GitHub Organization?

LLVM Project
1

I’m looking at a few different security settings for the LLVM Organization on GitHub, and I was curious if anyone is using personal access tokens to interact with the LLVM Organizations.

Note that if you create a pull request using your own fork and use a personal access token to push your code, you are not accessing the LLVM Organization, just your personal account, so these security settings would not apply to this use case.

The two security options I’m researching are:

  1. Blocking classic tokens from accessing the repository and only allowing the new fine-grained tokens.
  2. Requiring admin approval for accessing the LLVM Organization with fine-grained tokens.

I’m going to try to gather feedback about use cases for the personal access tokens and then decided if it’s worth perusing an RFC to turn one or both of these settings on.

Thanks,
Tom

2

I currently use the former.

Is there an alternative to using one of those two options, for pushing to GitHub from the command line?

3

I use access token (classic). Using a token is the only way to authenticate into GH from a command line, AFAIK. I select “repo”, “workflow”, and “packages” scopes for it, which I arrived at by some trial and error.

If we were to use fine grained tokens, what are the required permissions for the usual things, i.e. create/review/merge a PR, create/comment on/close issue, etc?

4

I use the classic token too. I haven’t really looked into what options are available though.

5

You can use ssh to push instead.

I think the available permissions are the same with both classic/fine-grained tokens, they just have slightly different names. With fine-grained tokens, you would want:

  • contents:write
  • issues:write
  • pull requests: write
  • workflows:write

The advantage of the fine-grained tokens, though, is that you can scope them to a specific repo. With the classic tokens, one token with write access can be used for any repository you have access to, but with fine-grained tokens, you can create one that only has access llvm/llvm-project.

1 Like
6

SPR requires the use of PATs to make stacked PRs: Set up spr - spr Documentation.

2 Likes
7

Just as an update—I’ve been using a personal access token based on Tom’s suggestions, and everything has been working fine for me.