steve/gadfly
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: scope reusable-workflow secrets (least privilege) over secrets: inherit #9

Merged
steve merged 3 commits from sec/scope-secrets into main 2026-06-28 01:17:16 +00:00
Conversation 10 Commits 3 Files Changed 6
+5 -1
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 18de9b8ebc - Show all commits
.gitea/workflows/review-reusable.yml
+5 -1
View File
@@ -80,7 +80,11 @@ jobs:
env: env:
# --- event context (from the CALLER's github.*) ------------------- # --- event context (from the CALLER's github.*) -------------------
GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }} GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} # github.token is the auto job token from the github CONTEXT (not a
# secret), so it's present even without `secrets: inherit`. Using
# secrets.GITEA_TOKEN here would be empty under explicit secret
# forwarding, since the auto token isn't a forwarded workflow_call secret.
GITEA_TOKEN: ${{ github.token }}
EVENT_NAME: ${{ github.event_name }} EVENT_NAME: ${{ github.event_name }}
PR: ${{ github.event.pull_request.number || github.event.issue.number || github.event.inputs.pr_number }} PR: ${{ github.event.pull_request.number || github.event.issue.number || github.event.inputs.pr_number }}
PR_BRANCH: ${{ github.head_ref }} PR_BRANCH: ${{ github.head_ref }}