Skip to content

Commit

Permalink
clean: Update terminology according to feedback
Browse files Browse the repository at this point in the history
  • Loading branch information
Cláudia Carpinteiro committed Jan 12, 2024
1 parent d54b9f4 commit 6c3ea23
Showing 1 changed file with 6 additions and 6 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -3,18 +3,18 @@ rss_title: Codacy release notes RSS feed
rss_href: /feed_rss_created.xml
---

# Deprecation of SSH keys for GitHub repositories January DD, 2024<!--TODO PLUTO-802 Update release date-->
# Discontinuation of SSH keys for GitHub repositories January DD, 2024<!--TODO PLUTO-802 Update release date-->

!!! info "This release note applies only to GitHub"

For increased security, Codacy deprecated the usage of **repository SSH keys** for Git operations on GitHub in favor of **installation access tokens**.
For increased security, Codacy is discontinuing the usage of **repository SSH keys** for Git operations on GitHub in favor of **installation access tokens**.

This change translates into important security improvements:

- It reduces the liability of the Codacy GitHub App, as it no longer requires [read and write repository permissions for Administration](https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps?apiVersion=2022-11-28#repository-permissions-for-administration).
- Contrary to long-living SSH keys, [installation access tokens](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app#about-installation-access-tokens) expire after one hour and Codacy loses access when the GitHub App is uninstalled.

To minimize any impact, Codacy deprecated the usage of repository SSH keys for now but will keep using them as a fallback mechanism at this first stage. At a later stage, Codacy will [delete the repository SSH keys](#timeline) stored in our systems.
To minimize any impact, Codacy is currently discontinuing the usage of repository SSH keys but will keep using them as a fallback mechanism at this first stage. At a later stage, Codacy will [stop using repository SSH keys and delete the keys](#timeline) stored in our systems.

## Changes on the Codacy GitHub App required permissions {: id="changes-permissions"}

Expand Down Expand Up @@ -45,7 +45,7 @@ To ensure the conditions to use installation access tokens on GitHub organizatio
<tbody>
<tr>
<td>January DD, 2024</td><!--TODO PLUTO-802 Update release date-->
<td>Codacy started using installation access tokens to clone and integrate with your repositories, and deprecated the usage of repository SSH keys</td>
<td>Codacy started using installation access tokens to clone and integrate with your repositories</td>
<td>
<p>From this day on, repository SSH keys are used exclusively as a fallback mechanism when the Contents permission is missing.</p>
<p>If not done yet, make sure an organization owner <a href="#to-do">approves Codacy GitHub App updated permissions</a> on your GitHub organization.</p>
Expand All @@ -61,10 +61,10 @@ To ensure the conditions to use installation access tokens on GitHub organizatio
</tr>
<tr>
<td>February 19, 2024</td>
<td>Codacy will remove repository permissions for Administration from the Codacy GitHub App and drop the usage of repository SSH keys</td>
<td>Codacy will remove repository permissions for Administration from the Codacy GitHub App and stop using repository SSH keys</td>
<td>
<p>Codacy will start using installation access tokens to clone and integrate with your repositories, with no fallback mechanisms. Also, repository permissions for Administration will be removed from the Codacy GitHub App.</p>
<p>If on this date the Codacy GitHub App updated permissions haven't been approved on your GitHub organization yet, your Codacy quality analysis will fail and you'll not be able to add new repositories to Codacy until an organization owner <a href="#to-do">approves the updated permissions.</a></p>
<p>If on this day the Codacy GitHub App updated permissions haven't been approved on your GitHub organization yet, your Codacy quality analysis will fail and you'll not be able to add new repositories to Codacy until an organization owner <a href="#to-do">approves the updated permissions.</a></p>
</td>
</tr>
<tr>
Expand Down

0 comments on commit 6c3ea23

Please sign in to comment.