GitHub is a hosted platform for version control, collaborative software development, and repository-based project management. In an engineering platform, a GitHub organization groups users and repositories, while teams provide a manageable boundary for delivery and access control. section 6.2.1 section 7.3.1
A practical GitHub setup for a platform team includes:
- Create an organization, add developers, create a platform-team team, and manage membership there. section 6.2.1
- Secure individual access with personal access tokens, uploaded SSH keys, and signed commits. section 6.2.1
- Use team membership as an authorization signal for connected tools and platform resources. section 7.3.1
- Connect GitHub to identity and delivery systems, using native integrations where available and synchronization APIs elsewhere. section 7.3.1
Platform-team access flow
A developer authenticates through GitHub and corporate identity. The platform identity service retrieves the developer’s GitHub team memberships, then returns secure access to infrastructure or custom API resources. CircleCI can connect permissions directly to GitHub teams; other SaaS tools may require synchronization. section 7.3.1
Figure 7.8 For Epetech, we would like our IDP service to have built-in or easily configurable means of integrating with GitHub, requiring authentication through whatever means we have set up in GitHub. As a result of (1) successful authentication, we want the IDP to (2) get the list of all teams the user is a member of in our GitHub organization. Finally, we want to (3) return to the user a secure means of accessing the platform infrastructure or custom API resources.
Trace the authentication flow from GitHub through team lookup to secure platform-resource access. section 7.3.1
