Skip to content

Commit 3c9fe26

Browse files
committed
Remove superfluous container authorization from release workflow
The "release" GitHub Actions workflow cross-compiles AVRDUDE in a container. At the time the workflow was written, the arduino/crossbuild container was configured as private, meaning it was necessary to configure the workflow to use a personal access token from an account with the necessary permissions in the `arduino` GitHub organization in order for it to be able to run. Since that time, the container has been made public. The configuration of the workflow to provide credentials for container access is now superfluous, making the workflow more difficult for use by contributors and reuse by the community, and increasing the project's maintenance burden and potential attack surface through the presence of an unnecessary token. This unnecessary workflow configuration is hereby removed, taking advantage of the new possibility of pulling the container anonymously.
1 parent 5cd451a commit 3c9fe26

File tree

1 file changed

+0
-3
lines changed

1 file changed

+0
-3
lines changed

.github/workflows/release.yml

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,6 @@ jobs:
4646

4747
container:
4848
image: ghcr.io/arduino/crossbuild:0.2.1
49-
credentials:
50-
username: ${{ github.actor }}
51-
password: ${{ secrets.AVRDUDE_CI_PAT }}
5249

5350
steps:
5451
# the tag must be formatted this way <AVRDUDE_TAG>-arduino.<ARDUINO_VERSION>, e.g tag -> 7.0-arduino.1

0 commit comments

Comments
 (0)