Integrating GitHub repositories with Azure Pipelines
Design and implement integration between GitHub repositories and Azure Pipelines
Three authentication types, and one is recommended
| Type | Runs as | Guidance |
|---|---|---|
| GitHub App | The Azure Pipelines identity | Recommended for CI; supports GitHub Checks |
| OAuth | Your personal GitHub identity | Supported; your repository access must remain active; no GitHub Checks |
| PAT | Your personal GitHub identity | Supported through a GitHub service connection, but discouraged; if necessary, use a narrowly scoped fine-grained PAT |
The GitHub App is the recommended type for CI. Once installed, builds and status updates use the Azure Pipelines identity rather than a personal GitHub identity. It also integrates with GitHub Checks to surface build, test, and coverage results in the pull request. OAuth and PAT integrations depend on the personal identity retaining the required repository access.
Scope it deliberately. Installing the app for all repositories in an organisation gives its token access to all of them, including private ones. Microsoft's guidance is to separate public and private repositories at the organisation level, or to explicitly select the repositories the app may access.
Forks are a policy-controlled security boundary
Organization or project controls under Pipelines → Settings → Triggers can disable fork-PR builds, securely build them, or customize the rules. New Azure DevOps projects and organizations default to disabling builds from forked GitHub repositories.
When Securely build pull requests from forked repositories is selected, a team member must comment before the pipeline runs, and the build receives neither pipeline secrets nor the same permissions as a normal build. This protects against untrusted fork code exfiltrating credentials. A pipeline's Triggers → Build pull requests from forks of this repository checkbox is an additional choice only where the central policy permits it.
Primary sources
- https://learn.microsoft.com/en-us/azure/devops/pipelines/repos/github
- https://learn.microsoft.com/en-us/azure/devops/pipelines/security/secure-access-to-repos
- https://learn.microsoft.com/en-us/azure/devops/release-notes/2023/pipelines/sprint-229-update
- https://docs.github.com/en/apps/using-github-apps/installing-a-github-app-from-a-third-party