Use job token where possible

It's possible if you set permissions packages:write and specify the image name explicitly
mering · Oct 31, 2023 · 6abd1b1 · 6abd1b1
1 parent ad8b5cc
commit 6abd1b1
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 11 deletions.
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -5,6 +5,9 @@ on:
   pull_request:
     branches: [ main ]
 concurrency: testing
+permissions:
+  contents: read
+  packages: write
 jobs:
   add_temp_pkgs1:
     name: Add temporary packages for testing
@@ -21,7 +24,7 @@ jobs:
         uses: docker/login-action@v2
         with:
           registry: ghcr.io
-          username: ${{ github.actor }}
+          username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: lower case repository
         id: lower_case_repository
@@ -54,7 +57,7 @@ jobs:
         uses: docker/login-action@v2
         with:
           registry: ghcr.io
-          username: ${{ github.actor }}
+          username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: lower case repository
         id: lower_case_repository
@@ -80,12 +83,12 @@ jobs:
       - uses: actions/checkout@v3
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
-      - name: Login to GitHub Container Registry with PAT_TOKEN
+      - name: Login to GitHub Container Registry
         uses: docker/login-action@v2
         with:
           registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.PAT_TOKEN }}
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - uses: ./
         with:
           token: ${{ secrets.PAT_TOKEN }}
@@ -118,7 +121,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: ./
         with:
-          token: ${{ secrets.PAT_TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           repository_owner: ${{ github.repository_owner }}
           repository: ${{ github.repository }}
           package_name: ${{ github.repository }}/p1

diff --git a/README.md b/README.md
@@ -129,7 +129,7 @@ delete all / untagged ghcr containers in a repository
 - name: Delete all containers from package without tags
     uses: Chizkiyahu/delete-untagged-ghcr-action@v2
     with:
-        token: ${{ secrets.PAT_TOKEN }}
+        token: ${{ github.token }}
         repository_owner: ${{ github.repository_owner }}
         repository: ${{ github.repository }}
         package_name: the-package-name
@@ -145,12 +145,12 @@ delete all / untagged ghcr containers in a repository
   uses: docker/login-action@v2
   with:
     registry: ghcr.io
-    username: ${{ github.actor }}
-    password: ${{ secrets.PAT_TOKEN }}
+    username: ${{ github.repository_owner }}
+    password: ${{ github.token }}
 - name: Delete all containers from package without tags
     uses: Chizkiyahu/delete-untagged-ghcr-action@v2
     with:
-        token: ${{ secrets.PAT_TOKEN }}
+        token: ${{ github.token }}
         repository_owner: ${{ github.repository_owner }}
         repository: ${{ github.repository }}
         package_name: the-package-name
@@ -164,7 +164,7 @@ delete all / untagged ghcr containers in a repository
 - name: Delete all containers from package
     uses: Chizkiyahu/delete-untagged-ghcr-action@v2
     with:
-        token: ${{ secrets.PAT_TOKEN }}
+        token: ${{ github.token }}
         repository_owner: ${{ github.repository_owner }}
         repository: ${{ github.repository }}
         package_name: the-package-name