Open tobozo opened 6 years ago
esp8266_deauther travis example
In order to push the binaries onto a tagged release page, the Travis script requires a github token generated by repository owner (it won't work with only collaborator perms). While the token isn't visible by anyone, the .travis.yml is still editable by collaborators as it's part of the repo.
Problem: anyone with permissions to modify the .travis.yml script can potentially add a command to use the token for any allowed github operation (e.g. poisoning the repo), while being identified as the repository owner.
or ...
or ...
While it's nice to have the translations added to the source folder, it does not add it to the compiled web interface, some manual operations are still required.
Several solutions should be available whenever a language is added or when an existing language is updated: