Security concerns with the GH_TOKEN

[namdao2000]

In order to deploy the application and release it on GitHub, my GH_TOKEN requires package:write scope on, which also gives a person the permission to delete/modify/add files to the private repo. On the other hand, the only privilege I need in the GH_TOKEN for distribution is for package:read, which only allows the person to download the packages. Any chance I can use the package:write GH_TOKEN for deployment and package:read token for the distributed app?

Thank you all in advance :D

[mmaietta]

That's a great concern.

Looks like it is not possible to use separate tokens at this time.
https://github.com/electron-userland/electron-builder/blob/master/packages/electron-publish/src/gitHubPublisher.ts#L45

token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN

https://github.com/electron-userland/electron-builder/blob/master/packages/electron-updater/src/providerFactory.ts#L23-L28

const token = (githubOptions.private ? process.env.GH_TOKEN || process.env.GITHUB_TOKEN : null) || githubOptions.token

I'd be happy to review a PR if you're interested in discussing a solution.
Contributing doc: https://github.com/electron-userland/electron-builder/blob/master/CONTRIBUTING.md#to-setup-a-local-dev-environment

[namdao2000]

Thank you for your reply mmaietta,

I am not good enough to contribute to the project, but I do hope someone out there can see this and fix this issue.

[ghost]

This is not a solution for your issue, but a temporary fix.

You may consider using a separate, public repo for your releases (if your original repo is private, which it is).

[stale]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

[jaydoherty]

I agree with this idea in theory. In my opinion, something like this should work:

1. Set your GH_TOKEN or GITHUB_TOKEN environment variable to your "private" token with publishing privileges.
2. Set "build": {"publish":{"token": "put your public lesser-privileged readonly token here"}}.

Sadly this doesn't work right now because electron-builder will completely ignore GH_TOKEN if "token" is specified directly in the configuration files. I know this from trying it out on electron-builder 22.14.5.

However...
Does GitHub allow tokens with only readonly scope? I thought GitHub only allowed users to create tokens with a minimum of BOTH pull AND push permission. I figured this was why electron-builder had never bothered to support separate tokens. At least, there is a long discussion on the topic here (with no progress as of December 2021): https://github.community/t/can-i-give-read-only-access-to-a-private-repo-from-a-developer-account/441

TL;DR: this feature might be impossible until GitHub allows more granularity in token permissions.

[ghost]

I'd rather not use a private repo and that's it. A GH token is very sensible data.

[mleister97]

Any updates on this?

I agree with this idea in theory. In my opinion, something like this should work:

1. Set your GH_TOKEN or GITHUB_TOKEN environment variable to your "private" token with publishing privileges.
2. Set "build": {"publish":{"token": "put your public lesser-privileged readonly token here"}}.

Sadly this doesn't work right now because electron-builder will completely ignore GH_TOKEN if "token" is specified directly in the configuration files. I know this from trying it out on electron-builder 22.14.5.

However... Does GitHub allow tokens with only readonly scope? I thought GitHub only allowed users to create tokens with a minimum of BOTH pull AND push permission. I figured this was why electron-builder had never bothered to support separate tokens. At least, there is a long discussion on the topic here (with no progress as of December 2021): https://github.community/t/can-i-give-read-only-access-to-a-private-repo-from-a-developer-account/441

TL;DR: this feature might be impossible until GitHub allows more granularity in token permissions.

Seperate keys would be possible. Please repoen this issue!

[AndrewEQ]

The year is 2024, if you're reading this and my PR doesn't make it in then here's the original commit to make use of the code: AndrewEQ@abea7ed