Update docs for fine-grained GitHub tokens
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- git, github, github-actions, javascript
- Domain
- authentication, ci-cd, documentation, security
Research direction
Start with the authentication sections in usage/ci-configuration and the linked semantic-release/git and semantic-release/github README sections. Update the GH_TOKEN descriptions, document regular versus fine-grained PATs and required scopes, and revise the branch-protection notes with cross-links. Done means all listed documentation locations consistently reflect the requested guidance.
Written by the indexing model from the issue text.
Description
Description
Following my exchange with @travi on GitHub's "Fine-grained personal access tokens" discussion, here's an issue to keep track of the notes I took, changes to be made, and to ask/receive feedback. Please let me know if I forgot anything!
Important points
- When using GitHub Actions, this is only necessary when using branch protection, otherwise, using the
permissionsfeature in workflows as described in the GitHub Actions documentation is enough. - When pushing to GitHub from other CI tools, using fine-grained PAT will increase the security in contrast to using a regular PAT (regardless of branch protection settings).
- Make clear that using a PAT is only needed to bypass branch protection, which is not relevant when not using
@semantic-release/git(https://github.com/semantic-release/git/issues/477)
Documentations to be updated
-
usage/ci-configuration#authentication
- update the
GH_TOKENvariable descriptions - add a section specifically for GitHub PAT (regular vs fine-grained) explaining the functioning and the security enhancements over regular PAT
- update the
-
recipes/ci-configurations/github-actions#pushing-package.json-changes-to-a-master-branch
- update the note about using a PAT to circumvent branch protection settings
- add a link to the newly added "GitHub PAT" section
-
semantic-release/gitREADME > Git authentication- add a link to the newly added "GitHub PAT" section
- add required fine-grained scopes for the plugin
-
semantic-release/githubREADME > GitHub authentication- add a link to the newly added "GitHub PAT" section
- add required fine-grained scopes for the plugin
Resources
Feedback wanted
- should we create the "GitHub PAT" section outside the
CI configurationsdropdown? if so, where do you think would be the most appropriate?
- Dominant language
- JavaScript
- Stars
- 339
- Forks
- 75
- Avg merge
- 5h 15m
- Merged PRs (30d)
- 6
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from semantic-release/git
-
semantic-release
Difficulty 3/5 1-2 days Newbie friendliness 35/100
semantic-release/git#584 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 30/100
semantic-release/git#536 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
semantic-release/git#532 · 3 reactions ·
-
Difficulty 3/5 1-2 days Newbie friendliness 28/100
semantic-release/git#531 · 1 comment ·
-
Dependencies upgrade Open
Difficulty 3/5 1-2 days Newbie friendliness 25/100
semantic-release/git#529 · 2 comments ·
All issues in semantic-release/git
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
HarperFast/skills#96 ·
-
[Block] Latest Posts [Type] Bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
sugarlabs/musicblocks#8847 ·