Skip to content

Commit a709ae0

Browse files
chore: update nightly build workflow to use a fine-grained GITHUB_TOKEN for generating nightly release notes (#1751)
1 parent 2e47978 commit a709ae0

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

.github/workflows/nightly-build.yml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,8 @@
225225
echo "Nightly tag already points to this commit. Skipping update."
226226
fi
227227
228-
228+
# 🚨⚠️ WARNING: the GITHUB_TOKEN under this step, has access to write & read access to Contents, Pull Requests
229+
# Which is why, it uses a fine-granted token with Read-Only Access to Public Repos Only.
229230
- name: Generate Release Notes (Experimental)
230231
if: ${{ success() && env.releaseRequired == 'true' }}
231232
id: gen-release-notes
@@ -237,6 +238,8 @@
237238
echo "$RELEASE_NOTES"
238239
echo "EOF"
239240
} >> $GITHUB_ENV
241+
env:
242+
GITHUB_TOKEN: ${{ secrets.NIGHTLY_RELEASE_NOTES_GH_TOKEN }}
240243
- name: Release Nightly Version
241244
# Only run this step, if not called from another workflow. And a previous step is successful with releasedRequired=true
242245
id: release

0 commit comments

Comments
 (0)