Repository navigation
ci: forward GH_TOKEN instead of inheriting all secrets - #325
Merged
Merged
Conversation
`release-plugin.yml` declares exactly one caller secret: the optional `GH_TOKEN` (used as `secrets.GH_TOKEN || secrets.GITHUB_TOKEN`). The automatic `GITHUB_TOKEN` reaches the called workflow without being passed, so `secrets: inherit` only ever forwarded `GH_TOKEN` while handing every other secret of the consumer repo to the callee as well. Forward that one secret explicitly and keep the built-in token as the fallback, so behaviour is unchanged for repos without a `GH_TOKEN` and repos that set one still get the override. Fixes #320
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #320.
release-plugin.ymldeclares exactly one caller secret, the optionalGH_TOKEN, and reads it assecrets.GH_TOKEN || secrets.GITHUB_TOKEN. The automaticGITHUB_TOKENalready reaches the called workflow without being passed, sosecrets: inheritonly ever forwardedGH_TOKENwhile also handing every other secret of the generated plugin repo to the callee.GH_TOKENsecret: the value falls back to the built-inGITHUB_TOKEN, so the release keeps working (GH_TOKENisrequired: false, and an empty secret does not fail the run).GH_TOKENto a PAT keep the override.GITHUB_TOKENpermissions are unchanged: the caller'spermissionsblock (contents/issues/pull-requests: write) still caps the token, and a caller cannot pass a secret name the callee does not declare — hence the key isGH_TOKEN, notGITHUB_TOKEN.Also drops the
secrets-inheritfinding from zizmor for every repo generated from the template.The
release-plugin.yml@mainref is intentionally left untouched.