canonical / canonical/github-profiles-automator
Security / Giving SSH keys of a Github user is too permissive and risky
- Dominant language
- Python
- Stars
- 1
- Forks
- 2
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 4
Description
### Bug Description
We should not provide SSH private keys, even if it is stored in Kubernetes as secret
https://charmhub.io/github-profiles-automator/configurations#ssh-key-secret-id
SSH keys are too sensitive to be used by applications
SSH keys in Github gives access to ALL repositories of the user
We should instead used token based permissions that is tailored for the application, something more similar to ServiceAccounts in Kubernetes
https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens
### To Reproduce
N/A
### Environment
Edge channel / Revision 200
### Relevant Log Output
```shell
N/A
```
### Additional Context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.