crickets-and-comb/shared

Don't use CHECKOUT_SHARED org token for actions/checkout.

開放

#32 建立於 2025年3月21日

 (0 則留言) (0 個反應) (0 位負責人)Makefile (0 個分叉)auto 404
enhancementhelp wanted

倉庫指標

星標
 (2 顆星)
PR 合併指標
 (PR 指標待抓取)

描述

In several workflows, where we use the GitHub action action/checkout to checkout the repository, we pass it an org secret called CHECKOUT_SHARED. Typically this accepts the temporary GITHUB_TOKEN, which is generated for each use and expires after use. This is preferred to passing a relatively permanent org secret to a third-party action.

Somehow, maybe because the checkout is recursive in order to checkout the shared git submodule, passing GITHUB_TOKEN has not worked correctly. (Details of repro unavailable at this time, so we'll need a fresh repro.)

There may yet be a way to just pass GITHUB_TOKEN. But, another solution would be to replace the action altogether with an in-house checkout. It may just be a simple shell git checkout. It can be wrapped in a reusable workflow if it's not a simple one-liner.

Replacing the action altogether would fulfill the adjacent goal to replace as many third-party actions as possible: https://github.com/crickets-and-comb/shared/issues/37

貢獻者指南