From a69f62275f54701b90e4b84c3e3b859d22df07bb Mon Sep 17 00:00:00 2001 From: Tim te Beek Date: Wed, 28 Feb 2024 14:41:17 +0100 Subject: [PATCH] Comment workflow does not need GITHUB_TOKEN passed in --- .github/workflows/comment-pr.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/comment-pr.yml b/.github/workflows/comment-pr.yml index 5b468ee570..e559610258 100644 --- a/.github/workflows/comment-pr.yml +++ b/.github/workflows/comment-pr.yml @@ -1,15 +1,15 @@ name: comment-pr + # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#using-data-from-the-triggering-workflow on: workflow_run: workflows: ["receive-pr"] types: - completed + # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ # Since this pull request has write permissions on the target repo, we should **NOT** execute any untrusted code. jobs: post-suggestions: if: ${{ github.event.workflow_run.conclusion == 'success' }} uses: openrewrite/gh-automation/.github/workflows/comment-pr.yml@main - secrets: - GH_PAT_ACTIONS_READ: ${{ secrets.GITHUB_TOKEN }}