JOSA Workshop | Least-Privilege CI/CD Auth with OIDC

Classic PATs (a.k.a GitHub PATs) get leaked, over-scoped, and rarely rotated. At multi-repo, multi-team scale that's exactly the setup that turns into an incident. Join us on for a hands-on workshop where you'll retire long-lived PATs in favor of short-lived, auto-issued, credentials and leave having migrated a real CI/CD pipeline yourself.
 

What you'll learn

• Why PATs are risky: how they get leaked, over-scoped, and forgotten.
• GitHub Apps vs. OIDC: how short-lived credential issuance actually works.
• How OIDC-based auth works in theory.
• Hands-on migration of a GitHub Actions pipeline from PAT-based auth to OIDC-based auth.
• Least-privilege scoping in practice: build a workflow limited to opening a PR in a single repo, then test that anything outside that scope gets denied.
• Auditing existing PATs across an org and building a phased deprecation plan.

Prerequisites

• Git & GitHub fundamentals (Intermediate).
• CI/CD concepts (built or maintained a pipeline (Intermediate).
• Basic understanding of tokens and authentication and authorization concepts.
• Comfortable reading/editing a YAML workflow file (Beginner).
• Laptop + a GitHub account with a sample repo.
   

Register
 

Trainer