Automatically Rotating GitHub Tokens (So You Don’t Have To)

Summary

Shopify needed automated GitHub workflows that could clone from private repositories, update organization-level projects, and trigger downstream workflows but could not use GITHUB_TOKEN. Personal access tokens supplied those capabilities, yet introduced developer churn, user-attributed actions, and no organization-enforced rotation or expiry. The proposed system uses GitHub Actions and a GitHub App to generate repository secrets that rotate automatically while preserving PAT-like references in existing workflows. Its serverless design delegates scheduling, managed infrastructure, approvals, secret management, auditing, and break-glass operation to GitHub, while a custom TypeScript action encrypts and writes generated secrets. Prototyping exposed that parallel one-second jobs could accrue multiple billable minutes, prompting sequential execution in a consolidated workflow; the stated goal is improved resilience to developer churn and reduced leaked-secret blast radius.

Takeaways

1. 1

   GitHub Apps provide separate credentials, names, and secrets, making automations more resilient to developer churn and avoiding attribution to personal developer accounts.

2. 2

   GitHub Actions billing rounds execution duration at the job level, so parallel jobs can accumulate multiple billable minutes even when each runs for about one second.

3. 3

   Generated secrets are placed in repository secrets, allowing existing workflows to reference them like PATs while rotations occur transparently in the background.