Open krystofwoldrich opened 5 months ago
This warning should not be triggered for changes in GH actions yml files.
This may be closed once https://github.com/getsentry/.github/issues/134 is fixed
This GH Issue is about adding a warning like https://github.com/getsentry/sentry-cocoa/pull/4091#issuecomment-2180159176
For example changes in https://github.com/getsentry/sentry-react-native/blob/9d86532d68474e40b8d0c346799236ab466c0cb7/plugin/src/withSentry.ts related to the authToken
variable should trigger such a warning.
Description
To prevent https://github.com/getsentry/sentry-react-native/security/advisories/GHSA-68c2-4mpx-qh95 in the future, we can add a GitHub Action which will add a warning to a PR when changes related to handling sentry auth token are included.
Impl can be a simple string search for
sentryAuthToken
,SENTRY_AUTH_TOKEN
, and similar.