Closed ocaisa closed 2 years ago
Confirmed in https://github.com/hpc-carpentry/hpc-carpentry.github.io/runs/3684415263 (and the resulting branch https://github.com/hpc-carpentry/hpc-carpentry.github.io/tree/gh-pages_check) that this works as expected, reverting the changes to check this...
When this is merged we should also remove the gh-pages_check
branch, and delete the secret that we use.
To clarify, secrets.GITHUB_TOKEN
is generated at build-time, not stored; and removing the stored secrets.JEKYLL_PAT
means we have no "state" "secrets" in the repo/settings to leak?
@tkphd Yes that's right, the GITHUB_TOKEN
token is created with the Github Action and is only valid as long as the Action, see https://docs.github.com/en/actions/security-guides/automatic-token-authentication for the full documentation.
If the existing secrets.JEKYLL_PAT
was leaked, that token would have full write permissions to the repo.
Some temporary changes included here to actually test this