dependabot/fetch-metadata
2
0
Fork 0
mirror of https://github.com/dependabot/fetch-metadata.git synced 2026-03-12 18:07:12 -04:00
Code Issues Packages Projects Releases Wiki Activity

Scope app token to only this repo for security (#501)

Browse Source 
https://github.com/dependabot/fetch-metadata/pull/442 bumped to a new version
of this action which now supports a `"repositories"` key that scopes the token
to the designated repositories.
This commit is contained in:
Jeff Widman
2024-03-20 21:19:31 -07:00
committed by GitHub
parent 7187f3911e
commit 3e1bcb99a1
4 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.github/workflows/dependabot-auto-merge.yml vendored
View File

@@ -13,6 +13,7 @@ jobs:
with:
app_id: ${{ secrets.FETCH_METADATA_ACTION_AUTOMATION_APP_ID }}
private_key: ${{ secrets.FETCH_METADATA_ACTION_AUTOMATION_PRIVATE_KEY }}
repositories: "dependabot/fetch-metadata"
- name: Check out code
uses: actions/checkout@v4

1
.github/workflows/dependabot-build.yml vendored
View File

@@ -37,6 +37,7 @@ jobs:
with:
app_id: ${{ secrets.FETCH_METADATA_ACTION_AUTOMATION_APP_ID }}
private_key: ${{ secrets.FETCH_METADATA_ACTION_AUTOMATION_PRIVATE_KEY }}
repositories: "dependabot/fetch-metadata"
- uses: actions/checkout@v4
with:

1
.github/workflows/release-bump-version.yml vendored
View File

@@ -24,6 +24,7 @@ jobs:
with:
app_id: ${{ secrets.FETCH_METADATA_ACTION_AUTOMATION_APP_ID }}
private_key: ${{ secrets.FETCH_METADATA_ACTION_AUTOMATION_PRIVATE_KEY }}
repositories: "dependabot/fetch-metadata"
- uses: actions/checkout@v4
with:

1
.github/workflows/release-move-tracking-tag.yml vendored
View File

@@ -34,6 +34,7 @@ jobs:
with:
app_id: ${{ secrets.FETCH_METADATA_ACTION_AUTOMATION_APP_ID }}
private_key: ${{ secrets.FETCH_METADATA_ACTION_AUTOMATION_PRIVATE_KEY }}
repositories: "dependabot/fetch-metadata"
- uses: actions/checkout@v4
with: