Skip to content

Commit 0c5ee14

Browse files
committed
Stop passing the CI App key to the shared design gate
The shared gate now runs every write on the job's GITHUB_TOKEN, which pull_request_target grants the declared write permissions even for fork PRs. The org CI App key can read every private repository, so public repositories should not hand it to any workflow.
1 parent c1a9998 commit 0c5ee14

1 file changed

Lines changed: 0 additions & 3 deletions

File tree

‎.github/workflows/design-gate.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,3 @@ jobs:
1414
pull-requests: write # gate comment, draft conversion, ready for review
1515
checks: write # publish the design-gate check run
1616
uses: cortexkit/subconscious/.github/workflows/design-gate.yml@master
17-
secrets:
18-
CK_CI_APP_ID: ${{ secrets.CK_CI_APP_ID }}
19-
CK_CI_APP_PRIVATE_KEY: ${{ secrets.CK_CI_APP_PRIVATE_KEY }}

0 commit comments

Comments
 (0)