@matheusbsbs / matheus-bagliano / commits / cc00362125

ci(check-whitespace): stop requiring a read/write token

As part of some recent security tightening, GitHub introduced the ability to configure GitHub workflows to be run with a read-only token. This is much more secure, in particular when working in a public repository: While the regular read/write token might be restricted to writing to the current branch, it is not necessarily restricted to access only the current Pull Request. However, the `check-whitespace` workflow threw a wrench into this plan: it _requires_ write access (because it wants to add a PR comment in case of a whitespace issue). Let's just skip that PR comment. The user can always click through to the actual error, even if it is slightly less convenient. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Johannes Schindelin committed Jul 14, 2021 at 22:09 UTC cc00362125c7726551d2b6bda85e1a4b17d0bc81

1 file changed -16

.github/workflows/check-whitespace.yml

-16

@@ -51,21 +51,5 @@ jobs:

52 if test -n "${log}"

53 then

54 - echo "::set-output name=checkout::"${log}""

54 exit 2

55 fi

57 -

58 - - name: Add Check Output as Comment

59 - uses: actions/github-script@v3

60 - id: add-comment

61 - env:

62 - log: ${{ steps.check_out.outputs.checkout }}

63 - with:

64 - script: |

65 - await github.issues.createComment({

66 - issue_number: context.issue.number,

67 - owner: context.repo.owner,

68 - repo: context.repo.repo,

69 - body: `Whitespace errors found in workflow ${{ github.workflow }}:\n\n\`\`\`\n${process.env.log.replace(/\\n/g, "\n")}\n\`\`\``

70 - })

71 - if: ${{ failure() }}