I don’t see how ecr pull through cache policy would use GitHub app to auth. You still need some token that gets added to secretmanager secret in other to read GitHub packages. I don’t think GitHub feature here would resolve anything as it is AWS authentication with GitHub packages.