Azure DevOps personal access token - Permissions

[pareion]

Hello!

We're in the initial phase of setting up the GitOps Connector in our Kubernetes Cluster.

We're using FluxCD and Azure Repos, which leads me to the question.

What kind of permissions should we grant the Personal Access Token required for the GitOps Connector.

We would love to go with only the minimal amount of permissions instead of everything, but we can't find anything in the documentation related to what kind of permissions the Personal Access Token needs.

Can you extend the documentation with the required permissions for the Azure DevOps PAT?

Notes:
I scanned the repository and compiled a list of the Azure DevOps REST APIs you're using. Based on this list, I found the following scopes are needed.

API list I found:

• https://learn.microsoft.com/en-us/rest/api/azure/devops/build/builds/get?view=azure-devops-rest-7.1
• https://learn.microsoft.com/en-us/rest/api/azure/devops/distributedtask/events/post-event?view=azure-devops-rest-7.1&tabs=HTTP
• https://learn.microsoft.com/en-us/rest/api/azure/devops/git/statuses/create?view=azure-devops-rest-6.0&tabs=HTTP
• https://learn.microsoft.com/en-us/rest/api/azure/devops/git/pull-request-properties/list?view=azure-devops-rest-6.0&tabs=HTTP
• https://learn.microsoft.com/en-us/rest/api/azure/devops/git/repositories/get-repository?view=azure-devops-rest-6.0&tabs=HTTP
• https://learn.microsoft.com/en-us/rest/api/azure/devops/git/pull-requests/get-pull-requests?view=azure-devops-rest-6.0&tabs=HTTP
• https://learn.microsoft.com/en-us/rest/api/azure/devops/git/commits/get?view=azure-devops-rest-6.0&tabs=HTTP

I wasn't able to find the endpoints in these files in Azures Rest API documentation

• https://github.com/Azure/gitops-connector/blob/main/src/orchestrators/azdo_cicd_orchestrator.py (My best guess would be the permission called vso.build)

Scopes needed to use the APIs:

• vso.code_write
• vso.code_status
• vso.code

Update:
I managed to get the status on commits and callback to Azure DevOps pipelines to work with the following permissions:
vso.build_execute vso.code_write vso.code_status