Skip to content

Commit 2f42074

Browse files
committed
strip duplicative auth examples
1 parent 6231816 commit 2f42074

2 files changed

Lines changed: 0 additions & 99 deletions

File tree

.github/workflows/04-advanced-features--04-github-permissions.yaml

Lines changed: 0 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -78,26 +78,3 @@ jobs:
7878
GH_TOKEN: ${{ github.token }}
7979
run: |
8080
gh pr edit 1 --add-label "documentation"
81-
82-
# ❌ PLEASE DO NOT USE THIS APPROACH!
83-
auth-to-aws-static:
84-
runs-on: ubuntu-24.04
85-
steps:
86-
- name: "Configure AWS Credentials using static key"
87-
uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
88-
with:
89-
aws-region: us-east-2
90-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
91-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
92-
93-
# ✅ PLEASE USE THIS APPROACH INSTEAD!
94-
auth-to-aws-oidc:
95-
runs-on: ubuntu-24.04
96-
permissions:
97-
id-token: write # This is required for requesting the JWT for OIDC auth to AWS
98-
steps:
99-
- name: "Configure AWS Credentials - Action for GitHub Actions"
100-
uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
101-
with:
102-
aws-region: us-east-2
103-
role-to-assume: arn:aws:iam::917774925227:role/github-actions-role

.github/workflows/04-advanced-features--05-third-party-auth.yaml

Lines changed: 0 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -2,83 +2,7 @@ name: Permissions
22
on:
33
workflow_dispatch:
44

5-
# Permissions can be defined at the workflow or job level
6-
# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
7-
################
8-
# Full Set
9-
################
10-
# permissions:
11-
# actions: read|write|none
12-
# attestations: read|write|none
13-
# checks: read|write|none
14-
# contents: read|write|none
15-
# deployments: read|write|none
16-
# id-token: write|none
17-
# issues: read|write|none
18-
# models: read|none
19-
# discussions: read|write|none
20-
# packages: read|write|none
21-
# pages: read|write|none
22-
# pull-requests: read|write|none
23-
# security-events: read|write|none
24-
# statuses: read|write|none
25-
################
26-
27-
################
28-
# Default (everything unspecified is "none")
29-
################
30-
# permissions:
31-
# contents: read
32-
# packages: read
33-
################
34-
355
jobs:
36-
read-only-pr:
37-
runs-on: ubuntu-24.04
38-
permissions:
39-
pull-requests: read # Can read PR data only
40-
continue-on-error: true # Avoids failing entire workflow
41-
steps:
42-
- uses: actions/checkout@v4
43-
44-
- name: Install GitHub CLI
45-
run: |
46-
sudo apt-get update -qq
47-
sudo apt-get install -y gh
48-
49-
- name: List the first 5 open PRs (allowed)
50-
run: gh pr list --limit 5
51-
env:
52-
GH_TOKEN: ${{ github.token }}
53-
54-
- name: Attempt to add a label (expected to fail)
55-
env:
56-
GH_TOKEN: ${{ github.token }}
57-
run: |
58-
gh pr edit 1 --add-label "documentation"
59-
60-
- name: Confirm the failure
61-
if: failure()
62-
run: echo "✅ Write operation was blocked as expected – token is read-only."
63-
64-
read-write-pr:
65-
runs-on: ubuntu-24.04
66-
permissions:
67-
pull-requests: write
68-
steps:
69-
- uses: actions/checkout@v4
70-
71-
- name: Install GitHub CLI
72-
run: |
73-
sudo apt-get update -qq
74-
sudo apt-get install -y gh
75-
76-
- name: Attempt to add a label (expected to succeed)
77-
env:
78-
GH_TOKEN: ${{ github.token }}
79-
run: |
80-
gh pr edit 1 --add-label "documentation"
81-
826
# ❌ PLEASE DO NOT USE THIS APPROACH!
837
auth-to-aws-static:
848
runs-on: ubuntu-24.04

0 commit comments

Comments
 (0)