Repository navigation
fix(github-actions): default to repo-scoped installation tokens and mask secrets in logs - #4026
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request refactors the getAuthTokenFor utility to support repository-scoped installation tokens, allowing GitHub Actions to request tokens with restricted access. It updates several actions to utilize these scoping options and introduces automatic token revocation in the release publish action. Additionally, comprehensive unit tests are added for both the token utility and the publish action. Feedback on the changes suggests adhering to the principle of least privilege in the org-file-sync action by scoping the token to specific repositories instead of requesting org-wide access, and validating that the minted token is a non-empty string to prevent downstream authentication failures.
b10b5ce to
95e3263
Compare
95e3263 to
89a6ae4
Compare
89a6ae4 to
36c27b4
Compare
36c27b4 to
a410562
Compare
|
This PR was merged into the repository. The changes were merged into the following branches:
|
2 participants
Default
getAuthTokenForto repository-scoped installation tokens (with explicit multi-repository scoping for org-level actions), mask minted installation tokens viacore.setSecret, and ensure installation tokens are always revoked infinallyduringrelease/publish.