From cffde71bf6f302ed53fa00e5e2235e9723b59cd0 Mon Sep 17 00:00:00 2001 From: James Addison Date: Sat, 8 Nov 2025 15:41:41 +0000 Subject: [PATCH 1/2] GitHub Actions Workflows: remove Personal Access Token usage --- .github/workflows/test.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 504c66bc..1cd5385c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -19,6 +19,8 @@ jobs: lint: name: Run Lint runs-on: ubuntu-latest + permissions: + contents: write steps: - name: Checkout to branch @@ -26,7 +28,6 @@ jobs: with: ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 0 # otherwise, you will fail to push refs to dest repo - persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal token - name: Setup Node.js 20.x uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 @@ -94,7 +95,7 @@ jobs: if: failure() && steps.verify-changed-files.outputs.files_changed == 'true' uses: ad-m/github-push-action@d91a481090679876dfc4178fef17f286781251df # v0.8.0 with: - github_token: ${{ secrets.PAT_TOKEN }} + github_token: ${{ secrets.GITHUB_TOKEN }} branch: ${{ github.head_ref }} From e7972a75e6e7ddb2c5207687d3e5649b7b922248 Mon Sep 17 00:00:00 2001 From: James Addison Date: Mon, 1 Dec 2025 10:12:23 +0000 Subject: [PATCH 2/2] GitHub Actions Workflows: revert, restoring removal credentials on checkout Partially reverts commit cffde71bf6f302ed53fa00e5e2235e9723b59cd0. --- .github/workflows/test.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 1cd5385c..d2d1d639 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -28,6 +28,7 @@ jobs: with: ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 0 # otherwise, you will fail to push refs to dest repo + persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal token - name: Setup Node.js 20.x uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0