I have been getting periodic deprecation notice emails from github for the last few months:
You recently used a password to access an endpoint through the GitHub API using okhttp/2.7.5. We will deprecate basic authentication using password to this endpoint soon:
We recommend using a personal access token (PAT) with the appropriate scope to access this endpoint instead. Visit https://github.com/settings/tokens for more information.
Thanks, The GitHub Team
@nenskins user, that is our old jenkins instance talking to
github somehow. Apparently through basic auth. Only… where? Most of the
github traffic seemed to use just an access token. Jenkins calls that the
secret text type. Basic auth is type
username with password in
What it turned out to be was the github branch source plugin. This periodically looks at our github organisation to see if there are new projects or new branches that it missed. Normally github tells our jenkins when there’s a new project or pull request or so.
Ok, on to the jenkins settings for my organisation. The confusing thing here is that the “credentials” setting says this:
Note that only "username with password" credentials are supported. Existing credentials of other kinds will be filtered out. This is because jenkins exercises GitHub API, and this last one does not support other ways of authentication.
Huh? Github is refusing user/password basic auth, which is what this plugin only supports? I updated every plugin, but the problem still persisted.
Isn’t that message saying that you can continue to use basic auth so long as instead of using your actual password you use a personal access token. Generate a personal access token from the GitHub “Settings” page and store that personal access token in the Jenkins username / password credential as the password. Place your username as the username. Check that it works. It has been working that way for me.
Ah! So “github is refusing user/password basic auth” really means “github is refusing user/password basic auth”. Using an access token instead of your password is actually fine.
The info in jenkins on those credentials actually mention that somewhat:
If your organization contains private repositories, then you need to specify a credential from an user who have access to those repositories. This is done by creating a "username with password" credential where the password is GitHub personal access tokens. The necessary scope is "repo".
So I visited https://github.com/settings/tokens and generated a new token with full “repo” rights (this is actually quite restricted in scope, despite the name).
In Jenkins I added a new global username/password credential with the github username + the access token and hurray, everything worked again.
My name is Reinout van Rees and I work a lot with Python (programming language) and Django (website framework). I live in The Netherlands and I'm happily married to Annie van Rees-Kooiman.
Most of my website content is in my weblog. You can keep up to date by subscribing to the automatic feeds (for instance with Google reader):