search

pulumi / pulumi-github

A Pulumi package to facilitate interacting with GitHub
Apache License 2.0
59 stars 10 forks source link

Ensure env var github token not stored in state #613

Closed VenelinMartinov closed 6 months ago

VenelinMartinov commented 6 months ago

What happened?

https://github.com/pulumi/pulumi-github/blob/632c46d96b5ca28d396de50d66beb44ba25b9bd3/provider/cmd/pulumi-resource-github/schema.json#L103

Looks like we have the same setup as in https://github.com/pulumi/pulumi-gcp/pull/1814

We set the config default from the env var which likely leads to the token being stored in state when it shouldn't.

Example

Run a pulumi-github program with GITHUB_TOKEN set - verify it is not saved in state.

Output of pulumi about

.

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction. To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

VenelinMartinov commented 6 months ago

Oddly this only reproes for non-default providers:

import * as github from "@pulumi/github";

const prov = new github.Provider("github");

const repo = new github.Repository("my-test-repo", {
    name: "my-test-repo"
}, {provider: prov})
VenelinMartinov commented 6 months ago

I tried to fix similar to the GCP issue but it did not seem to make a difference.

I also wasn't able to repro the GCP issue with expired credentials so the github provider might be handling this better or my setup might be off.