The current process uses a PAT owned, i.e. a single point of failure (If I don't press renew and update the token before it expires every 366 days).
The org version of PATs is to use a GitHub App, but the docs imply these need a server to run on (as that's typical usage).
It looks like it should be possible to actually have a Github App which is just used for the token, i.e. as an org PAT
https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/making-authenticated-api-requests-with-a-github-app-in-a-github-actions-workflow
The current process uses a PAT owned, i.e. a single point of failure (If I don't press renew and update the token before it expires every 366 days).
The org version of PATs is to use a GitHub App, but the docs imply these need a server to run on (as that's typical usage).
It looks like it should be possible to actually have a Github App which is just used for the token, i.e. as an org PAT
https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/making-authenticated-api-requests-with-a-github-app-in-a-github-actions-workflow