# Automating Orb Publishing **URL:** \ **Category:** Orbs\ **Created:** [November 30, 2018, 5:57pm UTC](https://discuss.circleci.com/t/automating-orb-publishing/26870 "2018-11-30T17:57:25Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![hutson](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/hutson/32/19875_2.png) [@hutson](https://discuss.circleci.com/u/hutson)\ **Post date:** [November 30, 2018, 5:57pm UTC](https://discuss.circleci.com/t/automating-orb-publishing/26870/1 "2018-11-30T17:57:25Z")
As the Organization owner of `github.com/hyper-expanse`, and the registrant of the `hutson` namespace in the Circle CI Orb registry, I have the ability to publish _production_ Orbs under that namespace. I do not manually publish Orbs, but instead, automate the process. That is because: - Publishing is a tedious process that does not add value to the process. - Changes to an Orb are vetted as part of the Pull Request review process. Once a change has been approved by the owner of an Orb, and subsequently merged into the repository’s _default_ branch, the assumption by all those involved is that the change may be published to production. Because only namespace owners may publish Orbs into production, my current workflow involves exposing a Circle CI Orb token through a Context to a CI job that does the publishing. I would prefer not to use my personal token. Doing so has several drawbacks: - All publishes occur as me, even if I am not the individual contributing a change, or approving it. - If I were to leave the GitHub organization, the workflow would break until another GitHub organization owner updates the Context with a new personal token. ---
**Author:** ![eddiewebb](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/eddiewebb/32/11733_2.png) [@eddiewebb](https://discuss.circleci.com/u/eddiewebb)\ **Post date:** [December 3, 2018, 6:15pm UTC](https://discuss.circleci.com/t/automating-orb-publishing/26870/2 "2018-12-03T18:15:47Z")
Hi @hutson, Your use case is perfectly valid, and a common concern in modern architecture where “promotions” or “deployments” have become non-human concerns. Unfortunately as you have discovered our services are tied to specific user accounts, and that includes the interactions with Orb publishing. While we continue to collect feedback and evolve our orb offering, including RBAC, I can only offer a work-around. To help users solve similar deployment problems elsewhere, Github suggests the creation of a [“Machine User”](https://developer.github.com/v3/guides/managing-deploy-keys/#machine-users) that has the rights required. This should address your two primary concerns by moving the ownership to a single protected non-human account with org level permissions. I’ll also make sure we have an idea card tracking this need specifically if not in our story collection yet. ---
**Author:** ![hutson](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/hutson/32/19875_2.png) [@hutson](https://discuss.circleci.com/u/hutson)\ **Post date:** [December 4, 2018, 6:29pm UTC](https://discuss.circleci.com/t/automating-orb-publishing/26870/3 "2018-12-04T18:29:55Z")
> [@eddiewebb](#): > > To help users solve similar deployment problems elsewhere, Github suggests the creation of a [“Machine User”](https://developer.github.com/v3/guides/managing-deploy-keys/#machine-users) that has the rights required. Our organization created a bot account several months ago to facilitate the creation of GitHub Releases (You can see how we use Circle CI to manage that job in my [`semantic-delivery`](https://discuss.circleci.com/t/orbs-sneak-peaks-share-your-orbs-in-progress/26008/3) Orb example). > [@eddiewebb](#): > > This should address your two primary concerns by moving the ownership to a single protected non-human account with org level permissions. Agreed! It seems like a like-for-like trade-off in that, though we end up with a _machine user_ that has owner access to our organization, the account, _technically_, has no more permissions than my own. It would be really nice, though, if some day we can migrate away from _machine users_ with _owner_ permissions, as they still introduce a significant single point of risk. ---
**Author:** ![system](https://global.discourse-cdn.com/circleci/original/3X/5/1/511608acda8e85906e15909b57bd0a46c1dbe291.png) [@system](https://discuss.circleci.com/u/system)\ **Post date:** [December 14, 2018, 6:30pm UTC](https://discuss.circleci.com/t/automating-orb-publishing/26870/4 "2018-12-14T18:30:10Z")
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.