semantic-release / semantic-release/git
Update docs for fine-grained GitHub tokens
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 339
- Forks
- 75
- Avg merge
- 5h 15m
- Merged PRs (30d)
- 6
Description
Description
Following my exchange with @travi on GitHub's "Fine-grained personal access tokens" discussion, here's an issue to keep track of the notes I took, changes to be made, and to ask/receive feedback. Please let me know if I forgot anything!
Important points
- When using GitHub Actions, this is only necessary when using branch protection, otherwise, using the
permissionsfeature in workflows as described in the GitHub Actions documentation is enough. - When pushing to GitHub from other CI tools, using fine-grained PAT will increase the security in contrast to using a regular PAT (regardless of branch protection settings).
- Make clear that using a PAT is only needed to bypass branch protection, which is not relevant when not using
@semantic-release/git(https://github.com/semantic-release/git/issues/477)
Documentations to be updated
-
usage/ci-configuration#authentication
- update the
GH_TOKENvariable descriptions - add a section specifically for GitHub PAT (regular vs fine-grained) explaining the functioning and the security enhancements over regular PAT
- update the
-
recipes/ci-configurations/github-actions#pushing-package.json-changes-to-a-master-branch
- update the note about using a PAT to circumvent branch protection settings
- add a link to the newly added "GitHub PAT" section
-
semantic-release/gitREADME > Git authentication- add a link to the newly added "GitHub PAT" section
- add required fine-grained scopes for the plugin
-
semantic-release/githubREADME > GitHub authentication- add a link to the newly added "GitHub PAT" section
- add required fine-grained scopes for the plugin
Resources
Feedback wanted
- should we create the "GitHub PAT" section outside the
CI configurationsdropdown? if so, where do you think would be the most appropriate?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the authentication sections in usage/ci-configuration and the linked semantic-release/git and semantic-release/github README sections. Update the GH_TOKEN descriptions, document regular versus fine-grained PATs and required scopes, and revise the branch-protection notes with cross-links. Done means all listed documentation locations consistently reflect the requested guidance.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- git, github, github-actions, javascript
- Domain
- authentication, ci-cd, documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100