Comments (9)
Thanks @vincerubinetti - I've just added a warning in the README. I hope that I can implement it leaving the majority of the logic which would be ideal. I will also refer in the README to the other action for people concerned :-)
from github-action-push-to-another-repository.
And main
branch has ssh deploy key support. I will wait a few days before tagging a new release to catch possible problems :-|
from github-action-push-to-another-repository.
Thanks @vincerubinetti and also to @nikita-volkov for reminding me of the original message. I'm looking at https://github.com/leigholiver/commit-with-deploy-key I will try implementing it using deploy keys. I accept pull requests for this if you had time before me (even without the unit tests; I've been postponing other changes for months because I don't have unit tests for the action yet).
I will also add a warning with the possible workaround.
from github-action-push-to-another-repository.
I will say that I ended up using that leigholiver/commit-with-deploy-key package, and it ended up working fabulously.
I only bring up this issue here because, again, this package seems to be the "defacto". That is, it comes up first on google, whereas the other package was hard to find.
It's possible you don't have to reinvent the wheel if the other package already fills that need. If you think that's the case, I agree it'd be great to put a big bold warning at the top of your readme, referring people to the other package if they want tighter security/scope.
from github-action-push-to-another-repository.
Closing issue (was included in the release v1.5)
from github-action-push-to-another-repository.
I absolutely agree. Using personal access tokens is a major vulnerability. It virtually makes this action unusable in a team setting, because anyone with write access to the repo where PAT is stored as a secret will be able to acquire or even mess with all your private repos via Github Actions. That is why it should not be recommended in the README and there should be a big red warning instead.
Thanks for the link. I was curious whether something like that is possible!
As an alternative (hacky) solution you can create a separate GitHub account and use it solely to generate a PAT, then you can control its access at each repository. E.g., in case of an org it can be thought of as a cross-org deployer bot and it can even have a dedicated email and be the author of the commits that you produce with this action.
from github-action-push-to-another-repository.
Actually it's an even larger security threat, which people with write-access to this action can exploit.
from github-action-push-to-another-repository.
New branch available: https://github.com/cpina/github-action-push-to-another-repository/tree/ssh-deploy-key that allows to use the personal access token (for backward compatbility) AND ssh keys.
I will do some more testing hopefully tomorrow, write documentation and merge to "main" (and release next week probably).
from github-action-push-to-another-repository.
Very responsible maintenance! Thank you!
from github-action-push-to-another-repository.
Related Issues (20)
- Getting error while pushing: RPC failed; HTTP 408 curl 18 HTTP/2 stream 7 was reset send-pack: unexpected disconnect while reading sideband packet fatal: the remote end hung up unexpectedly HOT 10
- "Nothing to commit, working tree clean" when there are clearly files to commit and push HOT 2
- Docs are not clear about if I can use a file instead of a directory HOT 1
- Exclude files to be deleted when files are copied HOT 2
- remote: fatal: did not receive expected object on Pull request HOT 7
- Action not working without parent directory HOT 4
- Action fails when it is triggered for more than one time from the same branch
- Documentation: add example with sphinx HOT 1
- Documentation: add quickstart steps HOT 1
- Documentation: improve FAQ for "filtering" HOT 1
- Remove unused variable SOURCE_BEFORE_DIRECTORY and input source-before-directory:
- Windows support HOT 7
- Composite version branch for Windows, Mac and hosted runners without containers
- Documentation: only Linux runners supported at the moment HOT 1
- possible to also push version info / tags? HOT 1
- keep the `.github` folder in the target repo. HOT 3
- Update docs to show that Github PATs now support find-grained access HOT 1
- Problem with NodeJS12 in the docker image HOT 1
- Support for partial updates HOT 2
- Sphinx plot_directive: _images directory not copied HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from github-action-push-to-another-repository.