CuraDevOps

tag: Github-Apps · 2 items

Plan GitHub Apps enterprise installations now generally available
2026-10-24 · GitHub Changelog · source ↗ #github-apps#enterprise-auth#supply-chain
  • Platform/SRE — Skip
  • CI/CD — Plan: GitHub Apps can now replace classic PATs for enterprise-wide automation; schedule an audit of existing PAT-based pipeline credentials and migrate to GitHub App installations for tighter scope and auditability — no forced deadline, but a clear security improvement to queue this quarter.
  • Leader — Learn: This GA capability enables org-wide policy to standardize on GitHub Apps over classic PATs for automation, which strengthens credential hygiene and reduces blast radius of leaked tokens; worth factoring into enterprise GitHub governance standards but no immediate decision required.
  • Signals: GA announcement
Plan GitHub Apps improve least-privilege access and PAT migration path
2026-10-14 · GitHub Changelog · source ↗ #github-apps#least-privilege#security
  • Platform/SRE — Plan: If your platform automation still uses classic PATs for GitHub API access, schedule a migration to fine-grained GitHub Apps tokens this quarter — fewer broad credentials reduces blast radius from a compromised token.
  • CI/CD — Plan: Pipelines relying on classic PATs for repo access or triggering workflows should be migrated to GitHub Apps with scoped permissions; no hard deadline, but this hardening step fits a Q4 supply-chain hygiene project.
  • Leader — Skip