CuraDevOps

tag: Least-Privilege · 2 items

Plan GitHub Apps improve least-privilege access and PAT migration path
2026-10-14 · GitHub Changelog · source ↗ #github-apps#least-privilege#security
  • Platform/SRE — Plan: If your platform automation still uses classic PATs for GitHub API access, schedule a migration to fine-grained GitHub Apps tokens this quarter — fewer broad credentials reduces blast radius from a compromised token.
  • CI/CD — Plan: Pipelines relying on classic PATs for repo access or triggering workflows should be migrated to GitHub Apps with scoped permissions; no hard deadline, but this hardening step fits a Q4 supply-chain hygiene project.
  • Leader — Skip
Plan archived GitHub Actions cache-mode enables least-privilege cache access
2026-09-11 · GitHub Changelog · source ↗ #github-actions#supply-chain#least-privilege
  • Platform/SRE — Skip
  • CI/CD — Plan: New GA GitHub Actions feature lets you scope cache read/write permissions per workflow or job, reducing blast radius of a compromised workflow. Evaluate and adopt cache-mode across pipelines this quarter as a supply-chain hardening step.
  • Leader — Skip