Secure 'Lint workflows' action

OpenSourceFellows / amplify-back-end

The API backend for ProgramEquity

https://www.programequity.com/

MIT License

10 stars 0 forks source link

Closed manishapriya94 closed 2 years ago

zengwuxin commented 2 years ago

@afcollins would you like to work on this together? I'm new to actions, but interested in learning more and hopefully contribute too

afcollins commented 2 years ago

Assigned to you @zengwuxin :)

zengwuxin commented 2 years ago

No secrets, scripts are used in the Lint workflows.👍
CODEOWNERS file has the dev team listed as a required PR approver for all code changes. 👍
Workflows is not accessing cloud resources, so OpenID connect does not apply. 👍
Workflows is not using a third-party action.👍
Do we want this action to scope the frontend repo too? If so, we might want to consider securing cross-repo access with github token.

zengwuxin commented 2 years ago

As far as the Amplify App goes, we will combine the frontend and backend repos. Also, github token almost always only works within a single repo.