actions-js/push

Secrets in a github repo shouldn't start with GITHUB_

AlyaGomaa opened this issue · 3 comments

i guess GITHUB_TOKEN in README.md should be changed

Hello @AlyaGomaa,

GitHub provides a token that you can use to authenticate on behalf of GitHub Actions. At the start of each workflow run, GitHub automatically creates a unique GITHUB_TOKEN secret to use in your workflow. You can use the GITHUB_TOKEN to authenticate in a workflow run.

You can use the GITHUB_TOKEN by using the standard syntax for referencing secrets: ${{ secrets.GITHUB_TOKEN }}. Examples of using the GITHUB_TOKEN include passing the token as an input to an action, or using it to make an authenticated GitHub API request.

Usage example:

name: Pull request labeler
on: [ pull_request ]

jobs:
  triage:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/labeler@v4
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

You can find more information here: https://docs.github.com/en/actions/security-guides/automatic-token-authentication

oh ok,
reading this in the readme gave me the impression that all secrets can start with GITHUB_ which is not true I guess?
thank you!

Yepp this is the only exception.