EwyBoy / World-Stripper

Strips away blocks to reveal the underground world gen. A must have tool for all map-makers, pack-makers or developers.
https://www.curseforge.com/minecraft/mc-mods/world-stripper
MIT License
13 stars 3 forks source link

[Feature] Safer Github Package Usage instructions #20

Closed MasterCash closed 2 years ago

MasterCash commented 2 years ago

Is your feature request related to a problem? Currently, you direct individuals to add their token to their gradle.properties file which is usually committed to the project. This is a security issue if that token were to get commited.

Describe the solution you'd like I would like to suggest a different approach to alert your users to use (if they are going to use github packages): Have them setup environment variables with the data and pull it in that way. it is safer and doesn't leave an avenue to commit their token to their repo for someone to find and exploit. Here is an example of what I use in my projects.

credentials {
  username = System.getenv("GITHUB_ACTOR")
  password = System.getenv("GITHUB_TOKEN")
}