GitHub Authentication token to use in Jira automation rule
Asked by sunny-gitdev:

Hi Team,

I have set up a following integration that links all GitHub organization repositories to JIRA.

<https://support.atlassian.com/jira-cloud-administration/docs/integrate-with-github/>

I am currently working on setting up a simple web request in the JIRA automation to trigger a GitHub actions workflow. I want to avoid using a Personal Access Token (PAT) from GitHub in the web request.

AFAIK, tokens in GitHub have a short lifespan, and using a PAT/classis token for production workflow is not recommended.

Is there an alternative authorization token I can see? Can I utilize any other type of token from GitHub within the JIRA automation, or is there another method for making a REST API Calls from JIRA automation web request?

Thank you!


Answers:
author: baban kumar
body: Hi Sunny

Were you able to generate the github app token at runtime in web request?

I am also struggling with same issue where we do not want to use PAT while calling github action from Jira web request.

comments: author: Gaurav Yadav
body: +1


author: sunny-gitdev
body: Hi [@baban kumar](/t5/user/viewprofilepage/user-id/5520528) and [@Gaurav Yadav](/t5/user/viewprofilepage/user-id/3893131),

Currently, there is no direct way in Atlassian to generate a runtime GitHub app token in JIRA web request. An alternative solution would be to send a request to Lambda and let Lambda handle the authentication part with GitHub; though this would add additional latency and complexity may vary based on your use cases.

However, I have found a way to use a Personal Access Token (PAT) in JIRA automation. There are three possible ways:

1) When creating a PAT for your existing user, you can either set a custom expiry date far away in the future for fine-grained tokens, or for classic tokens, set no expiration date at all. GitHub [strongly recommends that you set an expiration date](https://github.blog/changelog/2021-07-26-expiration-options-for-personal-access-tokens/) for your token to help keep your information secure.

2) FYI - I have tested my case with my github user PAT in JIRA automation it's working as expected, and further I will be using the following way to to prevent my user PAT from being used in production:

- You can create the service/machine user account (a brand new user account on Github.com); however an organization administrator will need to invite the account into the organization, either as an [outside collaborator](https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-user-access-to-your-organizations-repositories/managing-outside-collaborators/adding-outside-collaborators-to-repositories-in-your-organization) on an organization repository(granting read, write, or admin access), or to a [team](https://docs.github.com/en/enterprise-cloud@latest/organizations/organizing-members-into-teams/adding-organization-members-to-a-team) with access to the repositories it needs to automate (granting the permissions of the team).

3) By [creating an OAuth app](https://docs.github.com/en/enterprise-cloud@latest/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app) and [authorizing the OAuth App using the device flow](https://docs.github.com/en/enterprise-cloud@latest/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#device-flow), you can generate a long-lived token that doesn't have to be re-generated (with no expiry as far as Github can see) to use with JIRA.  

Please note that:  

* This will require a machine user (or a normal user) to authorize the OAuth App.
* The [Create a workflow dispatch event](https://docs.github.com/en/enterprise-cloud@latest/rest/actions/workflows?apiVersion=2022-11-28#create-a-workflow-dispatch-event) API endpoint requires that the OAuth App token has the `repo` scope.

I hope this information helps in your use case.

Thanks,

Sunny   


Tags: cloud

jira-cloud