GitHub App authentication

Daniel Cave June 12, 2023

Our security team is looking to disable all personal access tokens in our GitHub installation, one of the Dev teams is using Bamboo as their CD tool. 

We are being asked to pivot to using GitHub Apps https://docs.github.com/en/apps/creating-github-apps/about-creating-github-apps/about-creating-github-apps to authenticate.

Is this possible given the product?

1 answer

1 vote
Eduardo Alvarenga
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
June 12, 2023

Hey Daniel,

You can add the following system property to your Bamboo settings to forbid users from creating PATs:

  • -Dbamboo.access.token.user.max=0

Users will see the following when trying to add a PAT:

Bamboo-PAT.png

You can also block the following URLs on your Reverse Proxy:

  • <Bamboo_URL>/profile/userAccessTokens.action
  • <Bamboo_URL>/profile/createAccessToken.action

Regards,

Eduardo Alvarenga
Atlassian Support APAC

--please don't forget to Accept the answer if the reply is helpful-- 

Daniel Cave June 14, 2023

This does not solve my issues, which is how can we connect to GitHub from Bamboo using a GitHub App. 

I believe this is actually not possible however I wonder if someone has found a workaround.

Blocking PAT creation needs to happen in GitHub which I already have a solution for. 

Eduardo Alvarenga
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
June 14, 2023

Bamboo will interact with GitHub Repository as either a traditional Git Repository (either via SSH or HTTP). It also supports seamless authentication and GitHub Enterprise accounts, but it doesn't have any native support for GitHub Apps.

If you wish to use GitHub Apps, you may still run a script task that would invoke your program that will interface with GitHub. You can then use it before any other subsequent interactions with the repository.

Sincerely,

Eduardo Alvarenga
Atlassian Support APAC

--please don't forget to Accept the answer if the reply is helpful--

Like Steffen Opel _Utoolity_ likes this

Suggest an answer

Log in or Sign up to answer
TAGS
AUG Leaders

Atlassian Community Events