Repository navigation
fix(ui5-select): selection, styling and playground sample - #4
Merged
Merged
Conversation
|
|
MapTo0
approved these changes
Feb 11, 2019
ilhan007
added a commit
that referenced
this pull request
Jun 3, 2026
Replace every `secrets.UI5_WEBCOMP_BOT_GH_TOKEN` usage in the release workflow with a per-run installation token generated by `actions/create-github-app-token@v2`. App tokens are valid for ~1 hour and disappear when the run ends, drastically reducing the blast radius compared to a long-lived PAT. Aligns release.yaml with OSPO Guideline #4 ("Replace long-lived secrets with OIDC"). The same PAT is still consumed by deploy-preview.yaml, reset-preview-deploy.yaml, reset-gh-pages.yaml and issue-monthly-report.yaml; those workflows are intentionally out of scope and will be migrated in follow-up PRs. Requires (one-time, before merge): - Register a GitHub App with Contents/Issues/Pull-requests: write - Install it on SAP/ui5-webcomponents - Add it to the branch-protection bypass list for release branches - Add repo secrets RELEASE_BOT_APP_ID and RELEASE_BOT_APP_PRIVATE_KEY The npm publish flow already uses OIDC (id-token: write, no NPM_TOKEN); no changes there. UI5_WEBCOMP_BOT_NAME / _EMAIL are kept as-is — they are git identity strings, not credentials.
ilhan007
added a commit
that referenced
this pull request
Jun 3, 2026
…AT (#13604) * ci(release): use short-lived GitHub App token instead of long-lived PAT Replace every `secrets.UI5_WEBCOMP_BOT_GH_TOKEN` usage in the release workflow with a per-run installation token generated by `actions/create-github-app-token@v2`. App tokens are valid for ~1 hour and disappear when the run ends, drastically reducing the blast radius compared to a long-lived PAT. Aligns release.yaml with OSPO Guideline #4 ("Replace long-lived secrets with OIDC"). The same PAT is still consumed by deploy-preview.yaml, reset-preview-deploy.yaml, reset-gh-pages.yaml and issue-monthly-report.yaml; those workflows are intentionally out of scope and will be migrated in follow-up PRs. Requires (one-time, before merge): - Register a GitHub App with Contents/Issues/Pull-requests: write - Install it on SAP/ui5-webcomponents - Add it to the branch-protection bypass list for release branches - Add repo secrets RELEASE_BOT_APP_ID and RELEASE_BOT_APP_PRIVATE_KEY The npm publish flow already uses OIDC (id-token: write, no NPM_TOKEN); no changes there. UI5_WEBCOMP_BOT_NAME / _EMAIL are kept as-is — they are git identity strings, not credentials. * ci(release): pin create-github-app-token to v3.2.0 SHA, drop BOT prefix from secret names Addresses review feedback on #13604: - pin actions/create-github-app-token to v3.2.0 commit SHA per GitHub third-party action security guidance (tags can be moved, SHAs cannot) - v3 is safe for us: breaking changes are Node 24 (we use ubuntu-latest hosted runners which support it) and removed custom proxy handling (we do not use proxies) - rename RELEASE_BOT_APP_ID / RELEASE_BOT_APP_PRIVATE_KEY to RELEASE_APP_ID / RELEASE_APP_PRIVATE_KEY to match repo secret names * ci(release): keep GITHUB_TOKEN for experimental, drop App-token step Resolves the merge conflict between this PR and main introduced by 49bade4 ("swap PAT for GITHUB_TOKEN in experimental-release job"). experimental-release does not push tags or branches, does not create a GitHub release, and does not need elevated privileges — GITHUB_TOKEN is sufficient. Removes the now-unused 'Generate App Token' step from this job and reverts contents permission from write back to read. App tokens remain in stable/rc/hotfix/v1 jobs where they're needed for tag pushes against branch-protected refs. * ci(release): drop redundant GITHUB_TOKEN in experimental flow actions/checkout@v4 already defaults to github.token, and lerna version --no-push + lerna publish in this job do not need GH_TOKEN in env. Addresses review feedback on #13571.
ilhan007
added a commit
that referenced
this pull request
Jun 3, 2026
Replace secrets.UI5_WEBCOMP_BOT_GH_TOKEN with a per-run installation token from actions/create-github-app-token@v3.2.0 (pinned by SHA) in: - deploy-preview.yaml - reset-preview-deploy.yaml - reset-gh-pages.yaml - issue-monthly-report.yaml Completes the OSPO Hardening Control #4 ("Replace long-lived secrets with OIDC") migration started in #13604. release.yaml was migrated there; this PR covers the four remaining workflows that were called out as out-of-scope at the time. Once merged and one run of each workflow is verified green, the UI5_WEBCOMP_BOT_GH_TOKEN secret can be deleted and the underlying PAT revoked. The UI5_WEBCOMP_BOT_NAME and UI5_WEBCOMP_BOT_EMAIL secrets are kept — they are git identity strings, not credentials.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.