TechPrufer
Sign inGet started

Blogs›Shopify›GitHub Token Rotation and Management

GitHub Token Rotation and Management

GitHub Token Rotation and Management

1
posts
2022

This feature thread tracks the development and enhancement of Shopify's system for managing and automatically rotating GitHub Personal Access Tokens (PATs). Initial efforts focused on addressing the security and operational challenges associated with long-lived, manually managed PATs, such as vulnerability to developer churn, attribution difficulties, and lack of enforced rotation policies. The solution involves building a system that leverages GitHub Actions and GitHub Apps to transparently rotate tokens with short lifespans, ensuring improved security, audibility, and resilience against developer churn. The system aims to replicate the usage patterns of PATs while automating their rotation and management.

2022

Automatically Rotating GitHub Tokens (So You Don’t Have To) - Shopify

12/20/2022

This post details the development of a system to automatically rotate GitHub Personal Access Tokens (PATs). The system addresses limitations of GitHub's default `GITHUB_TOKEN` and manually managed PATs by implementing transparent, automatic rotations with short-lived expirations. It leverages GitHub Actions and a GitHub App for token generation, reducing reliance on individual developer accounts and mitigating risks from developer churn. Key design principles include transparency, short expirations, break-glass manual interventions, visible logging, and an approval flow. The post also discusses implementation challenges related to cost (billable minutes rounding) and scheduling reliability, leading to architectural refactoring and a shift in scheduling strategy.