Which of the following GitHub token types supports fine-grained repository permissions AND is recommended for CI/CD automation?

Question

Options

• APersonal Access Tokens (PATs)
• BGitHub App Installation Access Tokens
• CDevice Tokens
• DOAuth tokens

• B
  94% (33)
• C
  3% (1)
• D
  3% (1)

Explanation

GitHub App Installation Access Tokens are purpose-built for automation: they support fine-grained, repository-scoped permissions (read/write on specific resources like PRs, issues, or contents), expire automatically after 1 hour, and authenticate as an app identity rather than a human user - all properties GitHub explicitly recommends for CI/CD pipelines.

Why the distractors are wrong:

• A (PATs): Classic PATs use coarse all-or-nothing scopes; fine-grained PATs are newer and closer, but PATs are tied to a personal user account - a security liability in shared automation contexts.
• C (Device Tokens): These are part of the OAuth Device Flow for CLI/headless user authentication (e.g., logging into gh CLI on a machine with no browser) - not for automated service-to-service workflows.
• D (OAuth tokens): OAuth tokens authenticate on behalf of a user and are scoped to what that user can do, making them user-dependent and less suitable for autonomous CI/CD pipelines.

Memory tip: Think "App = Automation" - GitHub Apps were designed from the ground up for bots and pipelines, so their tokens are the natural fit. If a question mentions fine-grained + CI/CD, it's pointing at the token type that belongs to a non-human actor (an App), not a person.

No community discussion yet for this question.