Don't use CHECKOUT_SHARED org token for actions/checkout.
#32 创建于 2025年3月21日
仓库指标
- 星标
- (2 个星标)
- PR 合并指标
- (PR 指标待抓取)
描述
In several workflows, where we use the GitHub action action/checkout to checkout the repository, we pass it an org secret called CHECKOUT_SHARED. Typically this accepts the temporary GITHUB_TOKEN, which is generated for each use and expires after use. This is preferred to passing a relatively permanent org secret to a third-party action.
Somehow, maybe because the checkout is recursive in order to checkout the shared git submodule, passing GITHUB_TOKEN has not worked correctly. (Details of repro unavailable at this time, so we'll need a fresh repro.)
There may yet be a way to just pass GITHUB_TOKEN. But, another solution would be to replace the action altogether with an in-house checkout. It may just be a simple shell git checkout. It can be wrapped in a reusable workflow if it's not a simple one-liner.
Replacing the action altogether would fulfill the adjacent goal to replace as many third-party actions as possible: https://github.com/crickets-and-comb/shared/issues/37