3 ms·
GHA tokens can be scoped, see https://docs.github.com/en/actions/reference/authentication-in-a-workflow#permissions-for-the-github_token https://docs.github.com
by lazka 5y ago
GHA tokens can be scoped, see https://docs.github.com/en/actions/reference/authentication-in-a-workflow#permissions-for-the-github_token https://docs.github.com/en/actions/reference/authentication-...
- prepend 5y agoGP, and I agree, wants tokens to be scoped to repos, not to activities. Your link describes how you can limit the things you can do with a token. But GitHub doesn’t allow limiting where you can do those things. It’s annoying and I wish they would fix this. If you work on lots of repos across lots of orgs, this is a big vulnerability. I get the heebee-jeebies whenever I have to grant permission on something because if I make a mistake it could hose lots of things.