Skip to content

ci: use app for short lived token#496

Open
bd82 wants to merge 1 commit into
mainfrom
use_app_security
Open

ci: use app for short lived token#496
bd82 wants to merge 1 commit into
mainfrom
use_app_security

Conversation

@bd82
Copy link
Copy Markdown
Member

@bd82 bd82 commented May 13, 2026

No description provided.

@github-actions
Copy link
Copy Markdown
Contributor

Build Report

badge

Please note:

  1. Files only stay for around 14 days!
  2. This comment will be updated with the data of the last successful build of this PR.
Name Link
Commit 8ccf6ca
Logs https://github.com/SAP/app-studio-toolkit/actions/runs/25798789690
VSIX Files https://github.com/SAP/app-studio-toolkit/actions/runs/25798789690/artifacts/6969937226

@dellagustin-sap
Copy link
Copy Markdown

Hello @bd82 , I'm not an expert in GitHub Actions workflows, but I did a reviewed this PR and got some questions.
If I understood correctly, the token produced by your GitHub App is only needed for the step ChangeSets Release or PR creation, yet it is being used on actions/checkout, and thus available to all the subsequent steps.

I wonder if you could achieve the same results by restricting the usage of steps.app-token.outputs.token only to when it is needed.

I have proposed a refactored version with #514 , on top of this PR.
Note that I'm not 100% sure that would work, you would need to test it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants