Skip to content

Action requires GITHUB_TOKEN even for public repositories #331

Description

@anaPerezGhiglia

If the action is configured not to push and the configured repository is public, then the GITHUB_TOKEN should not be required, since the action should be able to clone the repository without it.

Currently the action fails due to the following validation, not because the action can't actually clone the repo.

    if (ghRepository) {
        validateGitHubToken('gh-repository', githubToken, 'to clone the repository');
    }

This is undesirable because it unnecessarily leads users to create PATs or fine-grained tokens, increasing their security exposure.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions