Authenticate protoc setup#5
Open
intel352 wants to merge 1 commit into
Open
Conversation
Pin setup-protoc before passing the built-in job token and keep GHES calls anonymous.
There was a problem hiding this comment.
Pull request overview
This PR hardens CI’s protoc installation step by authenticating GitHub release discovery on github.com (to avoid shared-runner API rate limiting) while keeping behavior safe/anonymous on GitHub Enterprise Server.
Changes:
- Pin
arduino/setup-protocto the verified v3.0.0 commit SHA. - Pass the built-in job token only when
github.server_urlishttps://github.comto avoid using an invalid token on GHES.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
arduino/setup-protocrelease discovery with the built-in GitHub job token on github.comWhy
Main Lint run 29270292677 failed in
Set up CI environmentbecause unauthenticated setup-protoc release discovery hit GitHub's shared-IP API limit. The failed-job rerun passed, confirming an external rate-limit flake. setup-protoc v3 documentsrepo-tokenspecifically for this boundary.No custom secret is added.
${{ github.token }}is the GitHub-provided job token expression, not a credential value.Verification
actionlint -ignore 'actions-rs/toolchain@v1' .github/workflows/*.ymlgit diff --checkc65c819552d16ad3c9b72d9dfd5ba5237b9c906bis the peeledv3.0.0tag commit