semantic-release / semantic-release/git

Update docs for fine-grained GitHub tokens

Open
#509 9 comments 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
339
Forks
75
Avg merge
5h 15m
Merged PRs (30d)
6

Description

Description

Following my exchange with @travi on GitHub's "Fine-grained personal access tokens" discussion, here's an issue to keep track of the notes I took, changes to be made, and to ask/receive feedback. Please let me know if I forgot anything!

Important points

  • When using GitHub Actions, this is only necessary when using branch protection, otherwise, using the permissions feature in workflows as described in the GitHub Actions documentation is enough.
  • When pushing to GitHub from other CI tools, using fine-grained PAT will increase the security in contrast to using a regular PAT (regardless of branch protection settings).
  • Make clear that using a PAT is only needed to bypass branch protection, which is not relevant when not using @semantic-release/git (https://github.com/semantic-release/git/issues/477)

Documentations to be updated

Resources

Feedback wanted

  • should we create the "GitHub PAT" section outside the CI configurations dropdown? if so, where do you think would be the most appropriate?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the authentication sections in usage/ci-configuration and the linked semantic-release/git and semantic-release/github README sections. Update the GH_TOKEN descriptions, document regular versus fine-grained PATs and required scopes, and revise the branch-protection notes with cross-links. Done means all listed documentation locations consistently reflect the requested guidance.

Written by the indexing model from the issue text.

Assessment

Tech stack
git, github, github-actions, javascript
Domain
authentication, ci-cd, documentation, security
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.