Azure-pipelines-tasks: expects a service connection with authentication scheme OAuth,PersonalAccessToken but is Scheme Token

[jeacott1]

Environment

• Server - Azure Pipelines
• Agent - Hosted

Issue Description

i have the devops github app installed and configured with hosted devops as a service connection.
attempting to use that same connection with 'task: GithubRelease@0' results in

Step input gitHubConnection expects a service connection of type github with authentication scheme OAuth,PersonalAccessToken but the provided service connection xxx is of type GitHub using authentication scheme Token.

[mdmdakbar]

@jeacott1 Endpoint created by devops github app installation is of scheme Token and we cannot use endpoint of type Token in tasks.

You can create a separate GitHub endpoint from service connections page of type OAuth or Personal Access Token (PAT) and use that instead in your task.

For creating a new GitHub connection, please refer this link

[jeacott1]

you realise how insane that sounds right?
why cant you use the github app installation scheme when it has write permission and an established connection already?

[raiyanalam]

@jeacott1 We understand the inconvenience that you are facing and my sincere apologies for that.
The issue here is that the GitHub App token has potentially much more exposure than a PAT or OAuth. The App token can have access to repositories in an organization that the user does not have access to at all. Allowing tasks to use this app token can have serious security implications. Hence, tasks are currently not allowed to use this token. As a work around you would have to use a PAT or OAuth which has slightly better permission scoped to the user only.

[jeacott1]

I was very apprehensive about installing the github app at all given it requires unfettered write permission, but having already made that decision, it seems a bit late to be worrying about auth specifically for pipelines.
Also my build server doesn't represent A user, it represents all of them.
If I'm using a personal token, in the context of an organisation, who's should I use?

given the also insane cost, and restriction to 1 repo per pipeline, and the other problems I've had so far with azure pipelines I think I'll give up and switch to something else.

Cheers.

[raiyanalam]

I am very sorry for the experience. We are currently looking into potential solutions to improve the way in which github app token can be used. As of now, I am afraid, I don't have a better solution to offer.
On the cost front, we do provide 10 free parallel jobs( unlimited minutes ) if your project is open source. You can find more details on pricing here.

[amaslenn]

Hello, I'm getting the same error.

I use a connection created with Github Personal Access Token. For some reason, I can't use it in my pipeline, I'm getting this error: The pipeline is not valid. Job release: Step GitHubRelease input gitHubConnection expects a service connection of type github with authentication scheme OAuth,PersonalAccessToken but the provided service connection release is of type github using authentication scheme Token.. I've checked this PAT manually and was able to create a release with it.

When I use OAuth-based connection the pipeline is OK, but seems it doesn't have permissions to create releases.

Any suggestions on how to solve it?

[amaslenn]

@prativen @raiyanalam any suggestions?

[romil07]

I have made a fix on this. Should be available soon.

[twpayne]

@romil07 Do you know when the fix will land?