GitHub warning about elevated privileges

[renevangsgaardjp]

Hi,

I just received an email from GitHub warning me that Renovate generated scoped installation tokens during a bug window with GitHub. The bug was that GitHub Apps were allowed to generate elevated privileges during the bug window, and Renovate was specifically mentioned by GitHub. Do you have any comments on this? Does Renovate continuously generate installation tokens for "normal" use?

GitHub message:

The following GitHub Apps generated scoped installation tokens during the bug window for your organization(s). We are not able to determine if a token was generated with elevated permissions:
Renovate

Thank you,
René

[rarkins]

Thanks for asking. I think that GitHub's communication (which I also received numerous times) was unfortunately lacking in clarity. I hope the below clarifies:

1. GitHub mentioned any app which generated any token within that one week window. Considering that tokens have a one hour validity, that covers most apps, and certainly Renovate because each time it runs it needs a token
2. Yes, this means Renovate like any other app must generate tokens for normal use, in fact it would be surprising if any installed app generated no token within a week because it means it didn't do anything for a week
3. Of course, all we can say is that Renovate did not generate any tokens with elevated privileges during that time. In fact we don't specify scopes when generating tokens - we use the default registered permissions.

[renevangsgaardjp]

Thank you the swift and reassuring reply.