Commits on Oct 28, 2024

1. winget: switch to using an Azure KeyVault …

   Instead of storing the Personal Access Token in an environment secret,
   store it in Azure KeyVault instead. This allows for much better auditing
   when (and where) the secret is used.
   
   Ideally, we would even switch away from using a Personal Access Token in
   the first place. But there is no alternative, such as a Managed Identity
   on GitHub, where one could define in a fine-grained way which usage
   scenario can be performed using that identity, and recent reorgs at
   GitHub suggest that adding such an alternative may not be on the list of
   priorities at all.
   
   So let's just stay with a Personal Access Token, but do safeguard it
   better by putting it into a KeyVault that can only be accessed by a
   narrowly-scoped GitHub Actions environment.
   
   Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

   

   dscho committed Oct 28, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for f6d195c
   • Browse repository at this point

   Copy the full SHA

   f6d195c View commit details

   Browse the repository at this point in the history