Use job token where possible (#32)

It's possible if you set permissions packages:write and specify the image name explicitly
Chizkiyahu · Nov 2, 2023 · 36327a9 · 36327a9
1 parent 278ac5c
commit 36327a9
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 9 deletions.
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -7,6 +7,9 @@ on:
   workflow_dispatch:
 
 concurrency: testing
+permissions:
+  contents: read
+  packages: write
 jobs:
   add_temp_pkgs1:
     name: Add temporary packages for testing
@@ -23,7 +26,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
-          username: ${{ github.actor }}
+          username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: lower case repository
         id: lower_case_repository
@@ -56,7 +59,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
-          username: ${{ github.actor }}
+          username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: lower case repository
         id: lower_case_repository
@@ -82,12 +85,12 @@ jobs:
       - uses: actions/checkout@v4
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-      - name: Login to GitHub Container Registry with PAT_TOKEN
+      - name: Login to GitHub Container Registry
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.PAT_TOKEN }}
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - uses: ./
         with:
           token: ${{ secrets.PAT_TOKEN }}
@@ -120,7 +123,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./
         with:
-          token: ${{ secrets.PAT_TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           repository_owner: ${{ github.repository_owner }}
           repository: ${{ github.repository }}
           package_name: ${{ github.repository }}/p1

diff --git a/README.md b/README.md
@@ -129,7 +129,7 @@ delete all / untagged ghcr containers in a repository
 - name: Delete all containers from package without tags
   uses: Chizkiyahu/delete-untagged-ghcr-action@v3
   with:
-      token: ${{ secrets.PAT_TOKEN }}
+      token: ${{ github.token }}
       repository_owner: ${{ github.repository_owner }}
       repository: ${{ github.repository }}
       package_name: the-package-name # full name includes the repository name if is connected to repository
@@ -150,7 +150,7 @@ delete all / untagged ghcr containers in a repository
 - name: Delete all containers from package without tags
   uses: Chizkiyahu/delete-untagged-ghcr-action@v3
   with:
-      token: ${{ secrets.PAT_TOKEN }}
+      token: ${{ github.token }}
       repository_owner: ${{ github.repository_owner }}
       repository: ${{ github.repository }}
       package_name: the-package-name  # full name includes the repository name if is connected to repository
@@ -164,7 +164,7 @@ delete all / untagged ghcr containers in a repository
 - name: Delete all containers from package
   uses: Chizkiyahu/delete-untagged-ghcr-action@v3
   with:
-      token: ${{ secrets.PAT_TOKEN }}
+      token: ${{ github.token }}
       repository_owner: ${{ github.repository_owner }}
       repository: ${{ github.repository }}
       package_name: the-package-name  # full name includes the repository name if is connected to repository