Skip to content

Provide github token via inputs (and defaults to secrets.GITHUB_TOKEN)#68

Open
StefMa wants to merge 2 commits intoBlackjacx:mainfrom
StefMa:update-gh-token-input
Open

Provide github token via inputs (and defaults to secrets.GITHUB_TOKEN)#68
StefMa wants to merge 2 commits intoBlackjacx:mainfrom
StefMa:update-gh-token-input

Conversation

@StefMa
Copy link
Contributor

@StefMa StefMa commented Jan 7, 2025

fixes #67

This is a nice feature as no one has to provide a github token anymore.
It still can be provided and depending on your use case it might be (because we ned access to other repos as well).
However, if you only reference the same repo, you have acces with that without adding a token 🚀

StefMa added 2 commits January 7, 2025 08:21
Add `gh-token` input to `action.yml` and update `src/index.js` and `README.md` accordingly.

* **action.yml**
  - Add a new input `gh-token` with a default value of `${{ secrets.GITHUB_TOKEN }}`
  - Update the description of the `gh-token` input to indicate its purpose

* **src/index.js**
  - Replace the usage of the environment variable `GITHUB_TOKEN` with the `gh-token` input

* **README.md**
  - Add documentation for the `gh-token` input in the inputs section
  - Update the example usage to include the `gh-token` input

---

For more details, open the [Copilot Workspace session](https://copilot-workspace.githubnext.com/StefMa/backlog-notifier?shareId=XXXX-XXXX-XXXX-XXXX).
@Blackjacx
Copy link
Owner

Hmm 🤔 Why should this be needed? Most GH actions consume the token provided by env. If you just omit the env, the default GH Token should be used since it is exposed as environment variable already...

@StefMa
Copy link
Contributor Author

StefMa commented Feb 16, 2026

The secrets.GITHUB_TOKEN is not added as a environment variable by default. It's a secret, and you have to pass it explicitly to the action.
There are two ways doing that, either via the global env: entrypoint, or via the steps.env: entrypoint.
If you don't do one of them, your action, or any other action that rely on an environment variable, don't have access to it.

If you create an workflow that uses multiple actions that needs the GITHUB_TOKEN as an environment variable, you of course can add it via the global env option. But I guess this is rarely the case.

With this new approach, user don't have to anything anymore. The token is passed via input automatically. It's just convenient because they don't even know that a token is required. They don't have to think about this at all.
Back in the day, when I created this PR, I see a lot of official actions using this pattern. Check the actions/ owner on github if you want.

However, this might be a breaking change for your consumers. As currently they might provide custom tokens via env variables, which now needs to be added via inputs.
However, I've a workaround for this if you think it's needed.

I hope this clarify some things ☺️

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Provide github token via inputs instead of env. variables

2 participants