Replace github.token by secrets.GITHUB_TOKEN

[Paulchen5]

Use the secrets.GITHUB_TOKEN instead of github.token which is kinda pointed out here: https://docs.github.com/en/actions/how-tos/security-for-github-actions/security-guides/use-github_token-in-workflows

[MikeMcQuaid]

Can you explain the security advantage here? I read the docs and don't see any.

Similarly, please remove all the stylistic changes here.

[Paulchen5]

I have reverted the style changes, sorry about that.

About the security advantage I am also kinda unsure tbh. For me the docs sound like that they encourage you to use the secrets.GITHUB_TOKEN. Besides that I guess it's more clear what the second syntax means and in most of your workflows you are already using the secrets.GITHUB_TOKEN style.

[MikeMcQuaid]

dev-cmd/tap-new.rb uses github.token too so may as well update that as well if the goal is consistency

[Paulchen5]

dev-cmd/tap-new.rb uses github.token too so may as well update that as well if the goal is consistency

Can you provide a link to the file? I don't find it my repository 😅 Or at least no file which should have github.token syntax in it.

[Bo98]

About the security advantage I am also kinda unsure tbh.

They are identical: https://docs.github.com/en/actions/reference/contexts-reference#github-context ("This is functionally equivalent to the GITHUB_TOKEN secret")

The only difference is that github.token can be used basically everywhere but secrets.GITHUB_TOKEN cannot: https://docs.github.com/en/actions/reference/contexts-reference#context-availability. For example, you cannot use secrets.GITHUB_TOKEN here: https://github.com/Homebrew/actions/blob/4449fc2e212bdcb83f1b67b077916a27c8730e54/setup-homebrew/action.yml#L31.

Doesn't however really matter for these specific cases in this PR.

[MikeMcQuaid]

Can you provide a link to the file?

No, please look harder. That's not the full path but a wide variety of tools can do this for you.

[Paulchen5]

Can you provide a link to the file?

No, please look harder. That's not the full path but a wide variety of tools can do this for you.

I mean the file path is probably Library/Homebrew/dev-cmd/tap-new.rb 🤷 but there are the changes already applied?

If there is still another file I am open to learn how to find it 😅

With the current VS Code search params I find nothing:

Also find doesn't find something else:

$ find . -type f -name 'tap-new.rb' | grep 'dev-cmd'
> ./Library/Homebrew/dev-cmd/tap-new.rb

[MikeMcQuaid]

I mean the file path is probably Library/Homebrew/dev-cmd/tap-new.rb 🤷 but there are the changes already applied?

Yup! Seem to be now, thanks.

[MikeMcQuaid]

Thanks!