Azure DevOps Pipelines and GitHub Repository Integration: Can OIDC Federation Replace PATs for Source Access?

Answer: No, Azure DevOps does not currently support OIDC federation for GitHub service connections.

Confirmed facts

• When creating a GitHub service connection in Azure DevOps (Services 2024.x and Server 2022), the authentication dropdown shows only "Personal access token" and "OAuth" options.
• Microsoft documentation and release notes list no OIDC‑based authentication for the GitHub source connector; OIDC federation is limited to Azure Resource Manager service connections (Azure AD workload identity).

Likely explanation

The GitHub service connection was designed around token‑based auth (PAT or OAuth) because GitHub’s own API expects those credentials. Extending the connection to accept a federated OIDC token would require a new credential type and token‑exchange flow that has not been implemented in the generally available product.

Officially supported PAT‑less alternatives

1. SSH key
   1. Generate an SSH key pair (or reuse an existing one).
   2. Add the public key to the target GitHub repository (Settings → Deploy keys) or to the user/account.
   3. Store the private key as a secure file in Azure DevOps (Pipelines → Library → Secure files) or encrypt it in a variable group.
   4. In the pipeline, download the secure file, set proper permissions (chmod 600), and use the SSH URL when cloning:

      # Bash step
      - task: DownloadSecureFile@1
        inputs:
          secureFile: 'github_ssh_key'
      - script: |
          mkdir -p ~/.ssh
          cp $(Agent.TempDirectory)/github_ssh_key ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          ssh-keyscan github.com >> ~/.ssh/known_hosts
          git clone [contact removed]:org/repo.git
        displayName: 'Clone via SSH'
      

2. GitHub App installation token
   1. Create a GitHub App with the needed repository permissions (e.g., Contents: read).
   2. Note the App ID and generate a private key; store both as secret variables (or in Azure Key Vault).
   3. Add a pipeline step that uses the App’s private key to sign a JWT and exchange it for an installation token (via GitHub’s API). Many community tasks or scripts exist for this.
   4. Use the resulting token as the http.extraHeader or in the Git URL (https://x-access-token:@github.com/org/repo.git) for clone/fetch operations.

Missing diagnostic detail

To recommend the simplest path, please confirm: Are you able to store an SSH private key as a secure file or variable group in your Azure DevOps project? If yes, the SSH‑key method is the most straightforward PAT‑less option; if not, consider the GitHub App approach.