Post #3338038
2025-02-18 16:08 UTC
@cuu508@toot.lv @healthchecks_io@fosstodon.org So, I've mostly created GitHub Apps for personal usage as well as for work purposes, so I'm a bit fuzzy on the best way to provide onboarding links. Easiest might simply be to use https://github.com/marketplace?type=apps. Yet on a conceptual level I really like the GitHub Apps permission model, where you get to add a GitHub App to your account/organization, together with the option of specificity exactly which repos you want to grant the App's access for.
Replies (1)
-
@andreas@mastodon.arrakis.se 2025-02-18 16:14
@cuu508@toot.lv @healthchecks_io@fosstodon.org In regards to security in general I would like to advice you to consider importing the GitHub App's long-lived private RSA key into something like an HSM, a Cloud KMS, a Vault instance, etc. While that doesn't prevent misuse it at least guards against the key fully leaking.