3 ms·
I am part of a few projects where for organizational reasons (e.g. corporate-community partnerships), we use `repository_dispatch` to trigger builds across repo
by hobofan 3y ago
I am part of a few projects where for organizational reasons (e.g. corporate-community partnerships), we use `repository_dispatch` to trigger builds across repositories. PATs are great here, as they can be scoped down to single repos and permissions.
There is a miniscule attack vector from using PATs here (maximum someone could do is trigger many GH Actions builds, but they also could do that otherwise), and to rotate the PAT, two people have to coordinate (as the origin repo has tighter permissions), and even though docs exist in the repo for how to rotate them, as it's a rare task people didn't find them the first year (second year is still coming up). For that use-case I'd greatly appreciate if PATs would exist that have a longer/no expiry.
- simonw 3y agoIt would be a bit complicated to implement and explain to end-users, but maybe there's a path here where you're allowed to set unexpiring tokens but only if the scopes they have are tightened beyond a specific level? A system that says "sure, you can have a token that doesn't expire if all you are doing is repository_dispatch" would be really useful to me too.