How do I link GitHub to the pipeline so it runs when new code is pushed?

The PAT securely authenticates Jenkins with GitHub without using your account password. In GitHub, go to Settings → Developer settings → Personal access tokens → Tokens (classic). Click "Generate new token", give it a descriptive name, and set an expiration date. Select at least these scopes: repo (for accessing repository code) and admin:repo_hook (for Jenkins to manage webhooks automatically). Copy the generated token immediately—it won't be shown again.

In Jenkins, go to Manage Jenkins → Credentials → System → Global credentials (unrestricted) → Add Credentials. For a freestyle job using HTTPS, select kind "Username with password", enter your GitHub username, and paste the PAT as the password. For pipeline jobs or automatic hook management, you may also add it as "Secret text" in the global GitHub configuration under Manage Jenkins → Configure System → GitHub → Add GitHub Server → Credentials (select the secret text credential).

In your GitHub repository, go to Settings → Webhooks → Add webhook. For Payload URL, enter your Jenkins URL followed by /github-webhook/ (e.g., http://your-jenkins-server:8080/github-webhook/). If Jenkins is on localhost, use ngrok to expose it: run ./ngrok http 8080 and use the generated ngrok URL. Set Content type to application/json, select "Just the push event" (or customize as needed), and ensure the webhook is active. You can add a secret for security, which must match the shared secret configured in Jenkins global GitHub settings.

If Jenkins cannot be exposed to the internet for webhooks, you can use Poll SCM as a fallback. In job configuration → Build Triggers, check "Poll SCM" and enter a cron schedule like H/5 * * * * to check for changes every 5 minutes. However, webhooks are strongly preferred for real-time triggering and reduced server load.

Always use Personal Access Tokens instead of passwords. Store tokens in Jenkins credentials, never hardcoded in pipelines. Set appropriate token expiration and rotate regularly. Use HTTPS for all connections and consider adding a webhook secret for additional verification. Ensure your Jenkins server is properly firewalled and accessed via HTTPS in production.