What's New: AL-Go for GitHub on Security (2025 release wave 1)

Overview

The video walks through security-related changes in AL-Go for GitHub. It starts with a website that lists upcoming deprecations, including changes that stop working after October 1st and build warnings for deprecated features.

It then covers Azure Trusted Signing, which removes manual certificate rotation and secret storage for code signing. It also covers GitHub App authentication, which uses short-lived tokens in place of personal access tokens, and storing install app URLs and SAS tokens in GitHub secrets. It ends with a demo of updating AL-Go system files on multiple branches, added in version 6.4.

Key points

• Azure Trusted Signing removes manual certificate rotation and secret storage for signing. Setup needs an Azure account, identity validation, a certificate profile, a managed identity, federated credentials and trusted signing settings in the GitHub repository.
• Identity validation is described as the hardest step of the Azure Trusted Signing setup.
• GitHub App authentication uses an app ID and private key to create short-lived access tokens (typically about an hour), scoped to specific permissions and organizations, with no user impersonation.
• GitHub App authentication does not work with GitHub Packages. A personal access token with packages reader permission is the workaround.
• Install app URLs and SAS tokens can be stored in GitHub secrets, so they are not in plain text in source code or logs.
• Version 6.4 can update AL-Go system files on multiple branches. A new workflow schedule setting takes a cron schedule and a list of branches.
• GitHub does not allow scheduling for multiple branches that are not the default branch. Features in release notes without a version number have not been released yet.

Features

Quotes

• 0:44 “So there are some changes in effect that will like stop working after October 1st this year and you’ll find those here.”
• 2:05 “the key takeaway for Azure trusted signing is that it’s the natural evolution of the signing process which completely eliminates the need to manually”
• 5:09 “the only thing that ever leaves the the GitHub runner is the shortlived access token that’s typically living for an hour”
• 5:09 “In your secret, you have an app ID and a private key. And that combination is used to create a short-lived access token.”
• 6:03 “There’s one scenario that doesn’t work. That’s GitHub packages”
• 8:53 “we should not have secrets in clear text. So what we did was we added a feature that enables you to instead of having”
• 10:38 “And with the latest version 6.4, 4 we actually added the capability to do that to update Ago system files on multiple branches at”
• 10:59 “So that’s why we added a new setting uh called workflow schedule where you can define your chrome schedule as well as list of”

Disclaimers in the video

• 1:23 preview: If you’ll find like features described on top of version 6.4, they will not be included in version 6.4, meaning that you probably have to run preview or yeah or or or they are not even in preview yet
• 6:03 not-in-this-release: There’s one scenario that doesn’t work. That’s GitHub packages. So, uh, that’s a feature that GitHub is is is missing

Presenters (as heard): Freddy Christensen, Maria Jilelesa.