On a related note - how are people tracking the absolute thicket of permissions quirks that is Github's various secrets, tokens & repo permissions?