4 ms·
> Said tokens didn't have admin access, but had enough privileges to invite other users to become full admins. Ah... Github permissions. What fun. Github actu
by cyberax 10mo ago
> Said tokens didn't have admin access, but had enough privileges to invite other users to become full admins.
Ah... Github permissions. What fun.
Github actually has a way to federate with AWS for short-lived credentials, but then it screws everything up by completely half-assing the ghcr.io implementation. It's only available using the old deprecated classic access tokens.
- catlifeonmars 10mo agoRight? How is it that you still need a PAT or a custom app installation to access a registry?
- fowl2 10mo agoYeah wow! Even most "trusted" contributors shouldn't have this level of access. Is there really no way of scoping tokens with more granularity?
- cyberax 10mo agoNope. The best we could do was to create a separate service that creates Docker tokens (using "docker login") and exposes a secure API. Obviously, GitHub needs to just fix this nonsense. But I interviewed a couple of "senior" engineers from GitHub, and I have zero hope of that happening soon.