2 ms·
As far as I can see they also have access to your secrets. I really haven't gotten myself to use any non-GitHub-defined Actions yet, because I haven't been able
by Vinnl 6y ago
As far as I can see they also have access to your secrets. I really haven't gotten myself to use any non-GitHub-defined Actions yet, because I haven't been able to verify if that's actually safe.
- kageneko 6y agoThey don't have direct access. You need to assign the secret in your workflow file. Example: steps: - uses: actions/checkout@v2 - uses: sfdx-actions/setup-sfdx@v1 with: sfdx-auth-url: ${{ secrets.SFDX_AUTH_URL }} or steps: - uses: actions/checkout@v2 - name: Run deployment script env: HEROKU_API_TOKEN: ${{ secrets.HEROKU_API_TOKEN }} The first is for an Action, the second is for a normal workflow script.
- Vinnl 6y agoAh neat, so without the `with`, the Action does not have access to my secrets? That alleviates my concerns.