Automatically Rotating GitHub Tokens (So You Don’t Have To) - Shopify

This post details the development and enhancement of Shopify's system for managing and automatically rotating GitHub Personal Access Tokens (PATs). It addresses the security and operational challenges of long-lived PATs by leveraging GitHub Actions and GitHub Apps to transparently rotate tokens. Key technical contributions include architectural design choices (serverless over service-full), the use of GitHub Apps for increased resiliency, and strategies for transparently replicating PAT usage patterns. The post also details significant 'gotchas' encountered during implementation, including cost implications of GitHub Actions billing (job-level billing and rounding) and the unreliability of the `schedule` trigger, leading to architectural refactoring and a shift in scheduling strategy.