--- id: video/W_gve2ty7VM type: video title: "What's New: AL-Go for GitHub on Security (2025 release wave 1)" summary: "AL-Go for GitHub security changes in 2025 release wave 1: a deprecations website (some features stop working after October 1st), Azure Trusted Signing to remove manual certificate rotation, GitHub App authentication with short-lived scoped tokens, secrets for install app URLs and SAS tokens, and multi-branch updates of AL-Go system files in version 6.4. Includes setup steps, the GitHub Packages limitation and the workflow schedule setting." tier: official language: en tags: - al-go - github - azure trusted signing - github app authentication - security - certificate rotation - secrets management - multiple branches - deprecations system: platform review: state: reviewed by: opus at: "2026-10-07T22:58:44.477Z" flags: [] generated: at: "2026-10-07T22:58:44.530Z" pipeline: 0.2.0 prompts: extract-video: 1 summarize-video: 2 input_hash: 76e89841120b3fdd60ca5ce4b5421da9fc22c8693d5909921d430ef58d73bcec evidence: - kind: video url: https://www.youtube.com/watch?v=W_gve2ty7VM&t=44s title: "What's New: AL-Go for GitHub on Security (2025 release wave 1)" date: "2025-04-01T15:00:45.000Z" commit: null t: 44 quote: So there are some changes in effect that will like stop working after October 1st this year and you'll find those here. - kind: video url: https://www.youtube.com/watch?v=W_gve2ty7VM&t=125s title: "What's New: AL-Go for GitHub on Security (2025 release wave 1)" date: "2025-04-01T15:00:45.000Z" commit: null t: 125 quote: the key takeaway for Azure trusted signing is that it's the natural evolution of the signing process which completely eliminates the need to manually - kind: video url: https://www.youtube.com/watch?v=W_gve2ty7VM&t=309s title: "What's New: AL-Go for GitHub on Security (2025 release wave 1)" date: "2025-04-01T15:00:45.000Z" commit: null t: 309 quote: the only thing that ever leaves the the GitHub runner is the shortlived access token that's typically living for an hour - kind: video url: https://www.youtube.com/watch?v=W_gve2ty7VM&t=309s title: "What's New: AL-Go for GitHub on Security (2025 release wave 1)" date: "2025-04-01T15:00:45.000Z" commit: null t: 309 quote: In your secret, you have an app ID and a private key. And that combination is used to create a short-lived access token. - kind: video url: https://www.youtube.com/watch?v=W_gve2ty7VM&t=363s title: "What's New: AL-Go for GitHub on Security (2025 release wave 1)" date: "2025-04-01T15:00:45.000Z" commit: null t: 363 quote: There's one scenario that doesn't work. That's GitHub packages - kind: video url: https://www.youtube.com/watch?v=W_gve2ty7VM&t=533s title: "What's New: AL-Go for GitHub on Security (2025 release wave 1)" date: "2025-04-01T15:00:45.000Z" commit: null t: 533 quote: we should not have secrets in clear text. So what we did was we added a feature that enables you to instead of having - kind: video url: https://www.youtube.com/watch?v=W_gve2ty7VM&t=638s title: "What's New: AL-Go for GitHub on Security (2025 release wave 1)" date: "2025-04-01T15:00:45.000Z" commit: null t: 638 quote: And with the latest version 6.4, 4 we actually added the capability to do that to update Ago system files on multiple branches at - kind: video url: https://www.youtube.com/watch?v=W_gve2ty7VM&t=659s title: "What's New: AL-Go for GitHub on Security (2025 release wave 1)" date: "2025-04-01T15:00:45.000Z" commit: null t: 659 quote: So that's why we added a new setting uh called workflow schedule where you can define your chrome schedule as well as list of links: learn: [] objects: [] features: [] topics: [] localizations: [] videos: [] posts: [] guidelines: [] video_id: W_gve2ty7VM channel: yt-microsoft source_name: Microsoft Dynamics 365 Business Central (YouTube) url: https://www.youtube.com/watch?v=W_gve2ty7VM published_at: "2025-04-01T15:00:45.000Z" duration_s: 715 captions: full audience: - developer - administrator chapters: - t: 0 title: Introduction and Deprecations - t: 111 title: Azure Trusted Signing Setup - t: 236 title: GitHub App Authentication - t: 496 title: Embed Secrets in Install Apps - t: 606 title: Multiple Branches Support and Demo features: - name: Deprecations Website status: unclear t: 26 verified: false status_source: video - name: Azure Trusted Signing Integration status: unclear t: 111 verified: false status_source: video - name: GitHub App Authentication status: unclear t: 236 verified: false status_source: video - name: Embed Secrets in Install Apps status: unclear t: 496 verified: false status_source: video - name: Multiple Branches Workflow Support status: unclear t: 606 verified: false status_source: video objects_mentioned: [] quotes: - t: 44 text: So there are some changes in effect that will like stop working after October 1st this year and you'll find those here. check: exact - t: 125 text: the key takeaway for Azure trusted signing is that it's the natural evolution of the signing process which completely eliminates the need to manually check: exact - t: 309 text: the only thing that ever leaves the the GitHub runner is the shortlived access token that's typically living for an hour check: exact - t: 309 text: In your secret, you have an app ID and a private key. And that combination is used to create a short-lived access token. check: exact - t: 363 text: There's one scenario that doesn't work. That's GitHub packages check: exact - t: 533 text: we should not have secrets in clear text. So what we did was we added a feature that enables you to instead of having check: exact - t: 638 text: And with the latest version 6.4, 4 we actually added the capability to do that to update Ago system files on multiple branches at check: exact - t: 659 text: So that's why we added a new setting uh called workflow schedule where you can define your chrome schedule as well as list of check: exact --- # What's New: AL-Go for GitHub on Security (2025 release wave 1) > AL-Go for GitHub security changes in 2025 release wave 1: a deprecations website (some features stop working after October 1st), Azure Trusted Signing to remove manual certificate rotation, GitHub App authentication with short-lived scoped tokens, secrets for install app URLs and SAS tokens, and multi-branch updates of AL-Go system files in version 6.4. Includes setup steps, the GitHub Packages limitation and the workflow schedule setting. [Watch on YouTube](https://www.youtube.com/watch?v=W_gve2ty7VM) · Microsoft Dynamics 365 Business Central (YouTube) · 2025-04-01 · 11:55 · tier official · reviewed (checked by Opus) ## Overview The video walks through security-related changes in AL-Go for GitHub. It starts with a website that lists upcoming deprecations, including changes that stop working after October 1st and build warnings for deprecated features. It then covers Azure Trusted Signing, which removes manual certificate rotation and secret storage for code signing. It also covers GitHub App authentication, which uses short-lived tokens in place of personal access tokens, and storing install app URLs and SAS tokens in GitHub secrets. It ends with a demo of updating AL-Go system files on multiple branches, added in version 6.4. ## Key points - Azure Trusted Signing removes manual certificate rotation and secret storage for signing. Setup needs an Azure account, identity validation, a certificate profile, a managed identity, federated credentials and trusted signing settings in the GitHub repository. - Identity validation is described as the hardest step of the Azure Trusted Signing setup. - GitHub App authentication uses an app ID and private key to create short-lived access tokens (typically about an hour), scoped to specific permissions and organizations, with no user impersonation. - GitHub App authentication does not work with GitHub Packages. A personal access token with packages reader permission is the workaround. - Install app URLs and SAS tokens can be stored in GitHub secrets, so they are not in plain text in source code or logs. - Version 6.4 can update AL-Go system files on multiple branches. A new workflow schedule setting takes a cron schedule and a list of branches. - GitHub does not allow scheduling for multiple branches that are not the default branch. Features in release notes without a version number have not been released yet. ## Chapters - [0:00](https://www.youtube.com/watch?v=W_gve2ty7VM&t=0s) Introduction and Deprecations - [1:51](https://www.youtube.com/watch?v=W_gve2ty7VM&t=111s) Azure Trusted Signing Setup - [3:56](https://www.youtube.com/watch?v=W_gve2ty7VM&t=236s) GitHub App Authentication - [8:16](https://www.youtube.com/watch?v=W_gve2ty7VM&t=496s) Embed Secrets in Install Apps - [10:06](https://www.youtube.com/watch?v=W_gve2ty7VM&t=606s) Multiple Branches Support and Demo ## Features | Feature | Status | At | |---|---|---| | Deprecations Website | status not stated | [0:26](https://www.youtube.com/watch?v=W_gve2ty7VM&t=26s) | | Azure Trusted Signing Integration | status not stated | [1:51](https://www.youtube.com/watch?v=W_gve2ty7VM&t=111s) | | GitHub App Authentication | status not stated, demoed | [3:56](https://www.youtube.com/watch?v=W_gve2ty7VM&t=236s) | | Embed Secrets in Install Apps | status not stated, demoed | [8:16](https://www.youtube.com/watch?v=W_gve2ty7VM&t=496s) | | Multiple Branches Workflow Support | status not stated, demoed | [10:06](https://www.youtube.com/watch?v=W_gve2ty7VM&t=606s) | ## Quotes - [0:44](https://www.youtube.com/watch?v=W_gve2ty7VM&t=44s) "So there are some changes in effect that will like stop working after October 1st this year and you'll find those here." - [2:05](https://www.youtube.com/watch?v=W_gve2ty7VM&t=125s) "the key takeaway for Azure trusted signing is that it's the natural evolution of the signing process which completely eliminates the need to manually" - [5:09](https://www.youtube.com/watch?v=W_gve2ty7VM&t=309s) "the only thing that ever leaves the the GitHub runner is the shortlived access token that's typically living for an hour" - [5:09](https://www.youtube.com/watch?v=W_gve2ty7VM&t=309s) "In your secret, you have an app ID and a private key. And that combination is used to create a short-lived access token." - [6:03](https://www.youtube.com/watch?v=W_gve2ty7VM&t=363s) "There's one scenario that doesn't work. That's GitHub packages" - [8:53](https://www.youtube.com/watch?v=W_gve2ty7VM&t=533s) "we should not have secrets in clear text. So what we did was we added a feature that enables you to instead of having" - [10:38](https://www.youtube.com/watch?v=W_gve2ty7VM&t=638s) "And with the latest version 6.4, 4 we actually added the capability to do that to update Ago system files on multiple branches at" - [10:59](https://www.youtube.com/watch?v=W_gve2ty7VM&t=659s) "So that's why we added a new setting uh called workflow schedule where you can define your chrome schedule as well as list of" ## Disclaimers in the video - [1:23](https://www.youtube.com/watch?v=W_gve2ty7VM&t=83s) preview: If you'll find like features described on top of version 6.4, they will not be included in version 6.4, meaning that you probably have to run preview or yeah or or or they are not even in preview yet - [6:03](https://www.youtube.com/watch?v=W_gve2ty7VM&t=363s) not-in-this-release: There's one scenario that doesn't work. That's GitHub packages. So, uh, that's a feature that GitHub is is is missing Presenters (as heard): Freddy Christensen, Maria Jilelesa.