Github personal token

[ghost]

Hi there, what permissions should we be setting when we create a personal token?

[Liopun]

@cazzzac Your personal token just needs repo permission for reading and writing to private repository. If it's a public repository, you might be able to get by with lower level access, but having full repo access is often simpler and more secure.

[ghost]

Thanks @Liopun:
What about if we're using the new fine-grain access tokens? I'm a bit rusty with GitHub, but say I create a private repo called 'Liopun' under my account and start assigning permissions just to that repo? Seems this would be a more secure way of managing access?

There's a whole new set of permissions that are available that don't easily map to the classic token settings you've got above (for all of my repositories). Do you know what I'd need to select in this new setup for fine grain access tokens?

[Liopun]

If you want to use fine-grained token that has access to a specific repo, you can do it by keeping this in mind:

1. PRP looks for a private repo called "prp-backup-repo" in your git repos, if not found, it creates a repo with that name
2. Since PRP just uploads your package list backup file to this repo, you need a token with permissions to write and read from prp-backup-repo

I haven't tried this but I think based on the picture above, your fine-grained token just needs Contents permission for writing and reading.