github / github/vscode-github-actions

false positive error on `secrets` context access in forks

Abierto
#375 3 comentarios 1 reacción 0 asignados Ver en GitHub
bug
Lenguaje dominante
TypeScript
Estrellas
660
Forks
213
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

For a workflow that accesses secrets:

```yml
- name: "publish npm"
uses: "./.github/actions/publish-npm"
env:
NPM_TOKEN: "${{ secrets.NPM_TOKEN }}"
```

The extension is very helpful in checking if the secret `NPM_TOKEN` is actually defined or not.
However, it only checks secrets defined in the same repository (I suspect `origin` remote), and reports a false-positive error if it was defined in `upstream`, and `origin` is actually pointing to a fork:

> Context access might be invalid: NPM_TOKEN

**Expected behavior**

All remotes to be checked for secrets, not just `origin`, and the error is no longer reported.

**Screenshots**

image

**Extension Version**
`v0.26.3`

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Start by locating the extension's validation of GitHub Actions secrets and how it determines the repository or remotes to inspect. Reproduce the fork-and-upstream scenario described in the issue, then verify that a secret defined upstream no longer produces a false-positive context-access error.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
github-actions, typescript, vscode
Área
ci-cd, devtools
Tipo de issue
Error
Dificultad
3/5
Tiempo estimado
1-2 días
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
45/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.