Enterprise installations for GitHub Apps are generally available, so enterprise governance and security automation no longer has to rely on classic PATs
New permissions cover enterprise rulesets, two-factor requirements, IP allowlists and more, so more automation can move from long-lived personal tokens to GitHub Apps.
// Key points
- GitHub Apps can be installed at the enterprise level, with the stated goal of replacing classic PATs in more enterprise and organization automation.
- New and expanded permissions cover managing enterprise repository policies and rulesets and reading delegated bypass requests; configuring two-factor requirements, verifying domains, managing IP allowlists and access restrictions; and updating enterprise profiles and member privileges and repository access settings.
- Two gaps at the organization level are also closed, and the updates will ship in GHES 3.24.
Builder's takeThe LiteLLM compromise started with stolen developer credentials. I'd list every classic PAT tied to a person and move whatever can go to a GitHub App this week: scoped permissions, short-lived tokens, nothing breaks when someone leaves. Accounts that approve releases deserve separate handling.
// Background · from #Coding agents
Full timeline →- Oct 24 LiteLLM 1.107.0 was a poisoned release: malicious code ran through Python startup hooks and stole credentials without LiteLLM ever being imported
- Oct 24 Claude proves 239 entry points across 123 open-source libraries won't crash on any input up to 64 MB, at the RISC-V assembly level
- Oct 24 Copilot usage metrics now name your own skills, custom agents and MCP servers, listing up to 25 per record