Douglas Liu
My feedback
3 results found
-
3 votes1 comment · Help us improve Gearset » Integrations and connections (Jira, source control, DX etc.) · Admin →Douglas Liu
supported this idea
·
-
6 votes0 comments · Help us improve Gearset » Integrations and connections (Jira, source control, DX etc.) · Admin →Douglas Liu
supported this idea
·
-
1 vote1 comment · Help us improve Gearset » Integrations and connections (Jira, source control, DX etc.) · Admin →
An error occurred while saving the comment Douglas Liu
shared this idea
·
Why This Is Important / Benefits:
1. Enhanced Security: This eliminates an entire class of credentials (the service account's PAT) that needs to be managed, rotated, and secured. Authentication would rely solely on the GitHub App's secure, short-lived tokens.
2. Simplified Administration: It removes the operational overhead of creating, managing permissions for, and eventually off-boarding a separate user account in GitHub just for the CI/CD process.
3. Clearer Attribution: A commit authored by Gearset App [ID: 123456] is a more precise and unambiguous audit trail than one authored by a generic svc-gearset user. It points directly to the application that performed the action.
4. Future-Proofs Gearset's Architecture: Adopting this "application-first" identity model aligns Gearset with the direction modern enterprise security is heading. It would be a strong selling point for security-conscious customers.
Here is an article related to this: https://josh-ops.com/posts/github-apps/#google_vignette