AZ-400 Question 225
Single answerYour organization hosts a private GitHub repository and uses Azure DevOps pipelines for CI/CD. You need the pipeline to not only clone the repository but also push changes back to it as part of an automated deployment process. Security and minimal permissions are a priority. Which authentication solution should you implement to ensure the pipeline can push changes while following best practices for GitHub Apps, tokens, and scopes?
- A
Store your GitHub username and password in plain text within the Azure DevOps pipeline variables to allow push access.
- B
Use a personal access token (PAT) with the entire 'repo' scope and check it into the pipeline� repository for easy access.
- C
Create a GitHub App with the necessary read/write permissions on the repository, then securely store and reference its credentials within Azure DevOps.
- D
Rely on the default GITHUB_TOKEN that GitHub Actions automatically provides, and configure it in your Azure DevOps pipeline environment variables.
Show answer and explanation
Correct answer: C
Explanation
When integrating external CI/CD systems like Azure DevOps with GitHub, using a GitHub App is generally considered a best practice. GitHub Apps can be granted necessary read/write access without exposing user credentials or unnecessarily broad access tokens. This approach also aligns with the recommended application-based authentication model provided in official documentation: https://docs.github.com/en/developers/apps. Storing credentials securely, for example in Azure Key Vault or protected pipelines variables, ensures minimal permissions and meets security requirements.
- A. Incorrect.
Incorrect. Storing plain text credentials in pipeline variables severely compromises security. Best practices recommend using more secure methods with token- or app-based authentication, never storing raw credentials in plain text.
- B. Incorrect.
Incorrect. Although a personal access token can grant repository access, checking it into your pipeline repository is an insecure practice. Additionally, using the entire 'repo' scope might exceed the minimal permissions required and is discouraged.
- C. Correct.
Correct. GitHub Apps offer fine-grained permissions and are recommended for integrations requiring repository access. By installing the App on the target repository and securely storing its credentials (for example, in Azure Key Vault or a protected variable group), you follow the principle of least privilege and maintain stronger security.
- D. Incorrect.
Incorrect. While GITHUB_TOKEN is a built-in token for GitHub Actions workflows, it is not automatically available in Azure DevOps pipelines and should not be repurposed outside GitHub Actions contexts. You need a method specifically designed for external CI/CD systems, like a GitHub App or a securely stored PAT.