A coding agent needs to create issues and push commits in three spe…

Question

A coding agent needs to create issues and push commits in three specific repositories, but should have no access to any other repositories in the organization. What is the most secure authentication configuration for this agent?

Accepted Answer

Create a GitHub App with issues:write and contents:write permissions, installed only on the three required repositories — A GitHub App is a VIP pass scoped to specific rooms, not a master key. You install it on exactly the three repositories you want to give it access to — it is physically incapable of touching any other repository in the organization, no matter what.

Answer

Create an organization-level personal access token with issues:write and contents:write scopes

Answer

Use the GITHUBTOKEN provided by GitHub Actions, which automatically scopes to the current repository

Answer

Create a machine user account in the organization and grant it collaborator access on the three repositories

A coding agent needs to create issues and push commits in three specific repositories, but should have no access to any other repositories in the organization. What is the most secure authentication configuration for this agent?

Short Explanation and Infographic

Full Explanation