Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove GH_PAT from all workflows #781

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

TomasHubelbauer
Copy link

@TomasHubelbauer TomasHubelbauer commented May 19, 2023

This is groundwork for using {{ github.token }} everywhere. We will need to add permissions to a few places to make the built-in GitHub Actions workflow integration PAT more powerful than how it comes by default:

https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/

I believe this is the optimal way to proceed to make the PR ready:

  • Review all workflows which pass GH_PAT/token through env to other GitHub Actions
    • actions/checkout - we can probably just not pass token to this right?

    • upptime/uptime-monitor - we should make a PR like this there first and use {{ github.token }} + permissions there instead of GH_PAT first and then drop the env here as a proof of concept

    • upptime/updates - we should make a PR like this there first and use {{ github.token }} + permissions there instead of GH_PAT first and then drop the env here as a proof of concept

    • benc-uk/workflow-dispatch - we should make a contribution there first to not need token and instead use {{ github.token }} + permissions

      This is already kind of done here Regression on token permissions benc-uk/workflow-dispatch#52 so theoretically we just need to pass permissions instead of token.

    • peaceiris/actions-gh-pages - we should make a contribution there first to not need github_token and instead use {{ github.token }} + permissions

      This is covered here: https://github.com/peaceiris/actions-gh-pages#%EF%B8%8F-first-deployment-with-github_token. When we don't pass a custom PAT there is an extra step needed in the GitHub Pages setup it seems. IMO worth doing this even with this extra step because that's just one step whereas as of now making the PAT is a series of steps.

  • Test out that with the now tokenless / implicitly tokened GitHub Actions the main repo still works as expected
  • Remove GH_PAT from the main repo (this PR) and add permissions with the necessary permissions
  • Test out that with the now tokenless / implicitly tokened main repo it still works as expected
  • Update the website and documentation to present a new and simpler Getting Started flow

I will try to contribute changes to the external dependencies first (benc-uk/workflow-dispatch and peaceiris/actions-gh-pages) to see if using {{ github.token }} and permissions there is even feasible. That will tell us whether this whole endeavor is doable at all. I think it should work but I don't know yet.

I will leave this draft PR open while I do this and update the steps here as I progress.

This is groundwork for using `{{ github.token }}` everywhere. We will need to add `permissions` to a few places to make the built-in GitHub Actions workflow integration PAT more powerful than how it comes by default:

https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/
@Zaid-maker
Copy link

Amazing Work! Good luck

@Zaid-maker
Copy link

Core package you should check this repo too, the core functionality written in that repo!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants