canonical / canonical/github-profiles-automator

Security / Giving SSH keys of a Github user is too permissive and risky

Open
#54 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
1
Forks
2
Avg merge
1d 11h
Merged PRs (30d)
4

Description

### Bug Description

We should not provide SSH private keys, even if it is stored in Kubernetes as secret
https://charmhub.io/github-profiles-automator/configurations#ssh-key-secret-id

SSH keys are too sensitive to be used by applications
SSH keys in Github gives access to ALL repositories of the user

We should instead used token based permissions that is tailored for the application, something more similar to ServiceAccounts in Kubernetes

https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens

### To Reproduce

N/A

### Environment

Edge channel / Revision 200

### Relevant Log Output

```shell
N/A
```

### Additional Context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.