[GHA] Fix token to trigger publish workflow#378
Conversation
| steps: | ||
| - name: Generate a token | ||
| id: generate_token | ||
| uses: tibdex/github-app-token@b62528385c34dbc9f38e5f4225ac829252d1ea92 |
There was a problem hiding this comment.
I'm not loving depending on an external action from some random GitHub user for this TBH. I get that it's pinned to a particular commit, but I worry about what happens if some vulnerability is found in this version that could cause a secret to leak—and I'm not willing to unpin it because that gives this random user access to our CI/CD pipeline and secrets.
Is there another way we can do this using something that comes from a reputable source (internal or external)?
There was a problem hiding this comment.
We use this Github action in several repos in Temporal to generate the token. There was no alternatives before until Github lauched their own. However, we're still using the former in several repos. I just copied this from another repo.
Anyway, I can replace here with the one provided by Github.
What was changed
Fix token to trigger publish workflow.
Why?
This workflow has been failing for months...
Checklist
Closes
How was this tested: