The webhook doesn't use down-scoped tokens - Githubissues

octo-sts / app

A GitHub App that acts like a Security Token Service (STS) for the Github API

Apache License 2.0

126 stars 15 forks source link

The webhook doesn't use down-scoped tokens #287

Open mattmoor opened 4 months ago

mattmoor commented 4 months ago

The webhook should be down-scoping tokens similar to the other paths like this: https://github.com/octo-sts/app/blob/8f1603b48e021800ba03ff83e0761d9b34ab1f7e/pkg/octosts/octosts.go#L264-L272

It has several places it does something like this: https://github.com/octo-sts/app/blob/8f1603b48e021800ba03ff83e0761d9b34ab1f7e/pkg/webhook/webhook.go#L221

cc @wlynch @cpanato