TowerGit ↔ CI/CD Pipeline: Least‑Privilege Authentication vs Expired Credentials

Goal

Implement a CI/CD workflow that uses TowerGit OAuth tokens with the minimal required scopes while ensuring that expired or revoked tokens do not silently allow pipeline execution.

Constraints

TowerGit exposes OAuth scopes such as read_repository, write_repository, and admin_repository to enforce least‑privilege access. However, the platform does not automatically expire personal access tokens (PATs); tokens remain valid until explicitly revoked or deleted. When a pipeline consumes a TowerGit PAT, the token value itself is not timestamp‑checked by TowerGit, so a pipeline will continue to succeed even if the token has expired in the TowerGit UI. TowerGit also lacks a built‑in notification mechanism for token expiration.

Unresolved Decision

Given the above behavior, there is uncertainty about how to guarantee that CI/CD jobs fail promptly when a token is no longer valid or about best practices for notifying pipelines of impending expiration.

Specific Questions

• Does TowerGit plan to introduce automated expiration checks for OAuth tokens in future releases?
• Can pipelines be configured to receive alerts or status updates when a TowerGit token is about to expire?
• What recommended pattern exists for detecting and responding to token revocation within a CI/CD pipeline?