Security concern about jekyll-deploy-action HOT 7 CLOSED

When I read the instructions right, it works like a charm. Now I finally can include my ruby script for not requiring date in post filenames.

Once again, thank you for your work and this great repo. Unfortunately, a star is all the support I can give you now, but do not think your work is not being appreciated.

from jekyll-deploy-action.

Hi @MikulasVanousek

Thanks for your reaching out. Could you point me out of the place in source code that is not safe? : )

Thanks and Regards

from jekyll-deploy-action.

Sorry, it is not the source code, it is the instructions. You need to generate a personal token and put it into your deploy action. If you push this action to a public GitHub repo, this would expose your personal token to public, right?

from jekyll-deploy-action.

Hi, I think you misunderstand the GitHub secrets, it's encrypted and safe for users, and it will not expose other people's personal token to public.

from jekyll-deploy-action.

You are right, probably right. I hope I did not bother you too much. Thank you for your contributions to the open source community.

from jekyll-deploy-action.

Hi @MikulasVanousek

Glad to hear that you have run this action successfully! Here is another plugin named jekyll-spaceship that I made, maybe you will have a need in the future.

Hope you have a good day! : )

Thanks and Regards

from jekyll-deploy-action.

Hi @MikulasVanousek

Now the latest version has supported to use the GITHUB_TOKEN to authenticate in a workflow run, it has better security. You can use the GITHUB_TOKEN by using the standard syntax for referencing secrets: ${{ secrets.GITHUB_TOKEN }}. For more information, you can see the README.

Thanks and Regards

from jekyll-deploy-action.