Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update the
hex.pm/orgs/dependabot
token (#7532)
The previous token was tied to a user account of someone who is no longer on the Dependabot team. When I removed that user from the Hex org, this [test started breaking](https://github.com/dependabot/dependabot-core/actions/runs/5487053978/jobs/9997970150?pr=7525). So this updates the token to an organization-based token, which is not tied to any user. This is a read-only token, which has access to _all_ private packages in the https://hex.pm/orgs/dependabot org. This is a security risk if we don't realize this and accidentally upload a private test package to this organization that we don't want to make public, but there's currently no way to prevent that other than using two separate organizations. I filed a feature request upstream: * hexpm/hexpm#1205
- Loading branch information