Portability · 01 of 06 · Today

Where GitHub is load-bearing today

GitHub is mostly an accident of where Hangar was built: a literal here, a curl there. In three places it is part of the design: the Crossplane resources that write to repositories, the GitHub App that mints CI tokens, and the annotation Tower uses to decide who owns an app.

Where GitHub is load-bearing today Four product zones, each calling GitHub.com and GHCR. Airframe composes 81 provider-upjet-github managed-resource templates, Repository and RepositoryFile, 88 of them live, highlighted as load-bearing, and has the owner jfillman as a literal in ten templates. Glidepath has fifteen places, thirteen catalog Tasks, a StepAction and a notify Job, calling the GitHub REST API for pull requests, comments, check runs and file contents, and a broker that mints one-repo GitHub App tokens valid for an hour. Tower and Backstage identify an app by its github.com/project-slug annotation, highlighted as load-bearing, and have an image client that refuses any registry but GHCR. Apron and Argo CD hold repository credentials as GitHub App credentials matched by the github.com/jfillman URL prefix, and the merge gate is a GitHub ruleset that trusts only the Pipelines as Code app integration id. All four share one vendor, one rate-limit bucket, one identity and one plan tier. MRS + URLSREST + APPREST + OAUTHGIT + APPAIRFRAME81 GitHub MR templates88 live · Repository · FileOwner is a literaljfillman in 10 templatesGLIDEPATH15 places call GitHubPRs · comments · checks · filesGitHub App brokerone-repo tokens, 1 hourTOWER + BACKSTAGEApp id = GitHub sluggithub.com/project-slugGHCR-only image clientother registries refusedAPRON + ARGO CDRepo creds by URLApp creds · github.com/jfillmanRuleset is the gatePaC app integration_idGitHub.com and GHCRone vendor · one rate-limit bucket · one identity · one plan tierTekton, Argo CD, ESO and cosign were never the problem. Three things are.LEGENDLoad-bearingA credential pathA literal or a driverThe vendorCalls

Load-bearing

  • RepositoryFile: 70 templates, 64 live, the source of the 2026-09 data loss and rate-limit storms.
  • github.com/project-slug: Tower authorization (ACC-05), approvers, catalog apps.
  • GitHub App tokens: the never-persisted credential the platform is built on.

Mechanical

The owner literal, ghcr.io in onboarding, hardcoded links, the Images tab and the prune call. Each is config or one driver, and none needs a design decision.

Already neutral

Tekton, Pipelines as Code (it speaks GitLab and Bitbucket), Argo CD, ESO, the dockerconfigjson pull secret, cosign and Rekor. They stay as they are.

Hangar · Portability