Replace star-history.com with a GitHub action? #3180

star-history.com now requires a token with the contents write scope in order to be recognized as collaborator and gain access to stargazers data. This token gets encrypted and included in embed URLs.

It is my understanding that this makes star-history.com a highly attractive target for attackers, because obtaining the private key would allow them to decrypt URL tokens which they can discover trivially through, e.g., GitHub's code search. Furthermore, any code that handles encryption and decryption is non-public and therefore not reviewable.

I would recommend that we instead use a GitHub action that regenerates the chart on a schedule and deploys it to either GitHub Pages or an external bucket. Actions are supposedly subject to different constraints and don't require write access to the repository.

Several actions already exist, and the star-history.com maintainer endorsed https://github.com/narayann7/star-history-action (which I haven't reviewed yet).