Skip to content

Commit b4cb479

Browse files
committed
fix: pass only required secrets to build-instrumented workflow
Replace 'secrets: inherit' with explicit GITHUB_TOKEN secret to follow security best practices. The build-instrumented-plugins.yaml workflow only requires GITHUB_TOKEN for GHCR authentication. Fixes GitHub security alert: githubactions:S7635
1 parent cf4cae9 commit b4cb479

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

.github/workflows/e2e-ocp-helm-pr.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,8 @@ jobs:
249249
with:
250250
workspace: ${{ matrix.workspace }}
251251
pr-number: ${{ inputs.pr-number }}
252-
secrets: inherit
252+
secrets:
253+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
253254

254255
e2e-test-with-coverage:
255256
needs: [detect-workspaces, build-instrumented]

0 commit comments

Comments
 (0)