Conversation
There was a problem hiding this comment.
Pull request overview
Updates the action documentation to clarify compat-lookup usage without requiring a Personal Access Token (PAT), aligning guidance with observed behavior when using the default GitHub Actions token.
Changes:
- Remove the claim that
compat-lookuprequires a PAT/App token (PAT still required foralert-lookup). - Add a new “Compatibility score” section with a workflow example and required token permissions.
- Add a note under
compat-lookupinput describing required permissions and linking to the new section.
Show a summary per file
| File | Description |
|---|---|
README.md |
Clarifies authentication requirements for compat-lookup and adds a usage example/section for compatibility score. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 1/1 changed files
- Comments generated: 3
| - If `true`, then populate the `compatibility-score` output. | ||
| - Defaults to `false` | ||
| - Note: the `github-token` field must be set to a [personal access token (PAT)](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token). | ||
| - Note: To use this field, `contents: read` and `pull-requests: read` permissions are required for `secrets.GITHUB_TOKEN`. For more details, see [this](#compatibility-score) |
There was a problem hiding this comment.
The compat-lookup note currently states that contents: read is required for secrets.GITHUB_TOKEN, but the action’s compat lookup itself doesn’t use the GitHub API (it fetches from dependabot-badges) and the README’s earlier minimal usage example enables compat-lookup without contents permissions. Consider rewording this to require pull-requests: read for the action, and only mention contents: read if the workflow also checks out the repo (or if you’ve confirmed it’s required by the action). Also, the doc block above recommends referring to the built-in token as github.token; using secrets.GITHUB_TOKEN here is inconsistent with that guidance.
| - Note: To use this field, `contents: read` and `pull-requests: read` permissions are required for `secrets.GITHUB_TOKEN`. For more details, see [this](#compatibility-score) | |
| - Note: To use this field with the default `${{ github.token }}`, `pull-requests: read` permission is required. If your workflow also checks out the repository or otherwise reads repository contents, `contents: read` may also be needed. For more details, see [this](#compatibility-score) |
There was a problem hiding this comment.
I fixed at 8677c57
I checked at followings
| on: | ||
| pull_request: | ||
|
|
There was a problem hiding this comment.
This workflow example uses the pull_request event, but earlier in the README there’s a note stating “The examples below use pull_request_target for this reason.” Either update that note to clarify that some examples intentionally use pull_request (read-only token, no access to user secrets), or switch this example to pull_request_target and add the corresponding security cautions.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…github.token }}` instead of `secrets.GITHUB_TOKEN`. ref. dependabot#691 (comment)
According to the information below, it states that a PAT is required to use
compat-lookup.fetch-metadata/README.md
Line 52 in 4c0bbfe
However, based on my investigation, I found that a PAT is not strictly necessary.
I have actually verified that it works using the configuration below.
job full log
While using a PAT is still an option, it should be avoided whenever possible for security reasons.
Therefore, I have added an explanation and an example of how to use
secrets.GITHUB_TOKEN.