casaroli commented on code in PR #3881:
URL: https://github.com/apache/nuttx-apps/pull/3881#discussion_r4314298421
##########
.github/workflows/build.yml:
##########
@@ -135,16 +135,19 @@ jobs:
- name: Apply depends-on PRs
if: ${{ steps.gittargets.outputs.depends_on != '' }}
shell: bash
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Review Comment:
Thank you for checking. I think it is safe here, and it is the same as the
"Determine Target Branches" step on master (line 46), which also sets
`GH_TOKEN` and calls `gh api`:
- The workflow has `permissions: contents: read, pull-requests: read`, and
for a fork PR the token is read-only.
- It is set only in the env of this one step, so the build steps do not get
it.
- This step runs no code from the PRs: only `git fetch`/`cherry-pick`, `gh
api` and the inline Python of the workflow.
- `secrets.GITHUB_TOKEN` is short-lived: GitHub makes a new one for each job
and revokes it when the job ends.
I think unsetting it would not help much: a `pull_request` run uses the
workflow file of the PR, so anyone can leak `${{ secrets.GITHUB_TOKEN }}` or
`${{ github.token }}`, which are the same token, with a new step.
It is needed, because without a token the GitHub API allows 60 calls per
hour per IP, and the runners share IPs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
