Figure out how to strip config of persisted credentials from checkout action

[JamesIves]

Right now you must run checkout@v2 with persist-credentials: false in order for the deployment to follow through correctly if you're using an access token variable. This is confusing, and has caused some discussion in the past.

It would be great if the action could tear down any pre-set variables from previous action runs so it starts on a fresh foot. The action already manages its own credentials so it should safely toss out any ones provided by others.

This is what persist-credentials actually does: https://github.com/actions/checkout/blob/main/src/git-auth-helper.ts#L137-L168

I'm open to discussions/ideas on how to prevent this and I've created an issue for this here: #507

[Pike]

Is this just for access tokens? SSH and GITHUB_TOKEN are fine?

I'm asking because I wanted to propose to drop the ACCESS_TOKEN feature. Happy to open a new post here to gather feedback. My concern is that it's very easy to create these tokens, and much harder to do so correctly. And I would think that one could generally use either a deploy key or just the GITHUB_TOKEN?

[JamesIves]

Some additional thoughts on this.

I think it's probably a good idea to remove the GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} variable all together in version 4. I think we should only be switching the deployment method if ACCESS_TOKEN or SSH is specified, and default to GITHUB_TOKEN. This is the approach a lot of the GitHub provided actions are taking now too as it's available to default in the action.yml file.

[Pike]

I like it.

Would that imply that if the checkout action uses SSH, the deploy action would do so, too?

[JamesIves]

No because the deploy key is not provided by default in all workflows. This will only be applicable to the Github token as it's always available. This just simplifies the boilerplate for 90% of workflows.

[JamesIves]

PR: #530

[emmahsax]

Personally, I don't like using the access_token. Because personal access tokens are valid for all of a GitHub user's repositories, it is allowed to do many things, and that seems slightly more dangerous to me than using secrets.GITHUB_TOKEN or SSH keys. Therefore, I'd be cool with dropping support for access tokens, but I also understand how some people might want to use that because then they can use one token for many projects.

In a different note, I'd be fine with it defaulting to secrets.GITHUB_TOKEN though.