Skip to content

Use GitHub App token instead of PAT in update workflows - #1702

Open
Kaniska244 wants to merge 1 commit into
devcontainers:mainfrom
Kaniska244:key-update
Open

Use GitHub App token instead of PAT in update workflows#1702
Kaniska244 wants to merge 1 commit into
devcontainers:mainfrom
Kaniska244:key-update

Conversation

@Kaniska244

@Kaniska244 Kaniska244 commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

This pull request updates the GitHub Actions workflows for documentation, AWS CLI completer scripts, and .NET install script automation. The main goal is to improve security by replacing the use of a personal access token (PAT) with a GitHub App token for authentication, and to reduce workflow permissions to the minimum required.

Authentication and Permissions Improvements:

  • Replaced the use of secrets.PAT with a GitHub App token generated via the actions/create-github-app-token@v2 action for all workflows (update-documentation.yml, update-aws-cli-completer-scripts.yml, and update-dotnet-install-script.yml). The App ID and private key are now sourced from devcontainers organization variables and secrets. [1] [2] [3]
  • Updated the GITHUB_TOKEN environment variable in the PR creation steps to use the newly generated GitHub App token instead of the PAT. [1] [2] [3]
  • Reduced workflow permissions from contents: write and pull-requests: write to contents: read, following the principle of least privilege. [1] [2] [3]

Workflow Steps Updates:

  • Modified the checkout steps to use the generated GitHub App token for repository access, ensuring all git operations use the correct authentication context. [1] [2] [3]

Prerequisites:

  • devcontainers-repos-automation GitHub App registered on the org and installed on devcontainers/features (Contents R/W, Pull requests R/W, Issues R/W, Metadata R).
  • Org variable DEVCONTAINERS_REPO_AUTOMATION_ID and org secret DEVCONTAINERS_REPO_AUTOMATION_PRIVATE_KEY added, scoped to this repo.

These changes enhance workflow security and align with GitHub's best practices for automation and token management.

@Kaniska244
Kaniska244 marked this pull request as ready for review August 3, 2026 15:34
@Kaniska244
Kaniska244 requested a review from a team as a code owner August 3, 2026 15:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant