Replacing PAT with GitHub App

[jpitts (JP)]

@sanzoghenzo

Which may respond that PAT = PERSONAL Acces Token, and shouldn’t be shared in the first place.

Install and update pyRevit extension from a private repo

@GooseG replying to your second question first: the token is produced only for the github admin (or whatever github manager role) so only once. my approach today, with my colleagues: user installs pyrevit (could install pyrevit CLI only but that would require to clone and install pyrevit repo as an extra step (pyrevit clone …) I get them to run from the command line : pyrevit extend ui extensionName https://github.com/gituser/repoName.git --dest="C:\xxxx" --token= "6984ef654eaf6a54f65ef" …

I thought that using the same PAT is the recommended approach? Or are you just acknowledging that while recommended, is still a security vulnerability?