From 2e5ab1fe22bb25e36153375d6e575f3b81f23378 Mon Sep 17 00:00:00 2001 From: Marc Izquierdo Date: Tue, 20 Oct 2026 19:58:02 +0200 Subject: [PATCH 1/2] Stop requiring GITHUB_TOKEN The action never used it. Keep the input, now optional, so workflows that pass it don't get an "unexpected input" warning, and keep its args slot so the other args stay in place. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/test.yml | 1 - README.md | 3 --- action.yml | 5 +++-- src/main.sh | 2 +- 4 files changed, 4 insertions(+), 7 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index f7037cdf..368dd45d 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -13,7 +13,6 @@ jobs: - uses: actions/checkout@v5 - uses: ./ with: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} TEAMWORK_URI: "localhost" TEAMWORK_API_TOKEN: "test_api_token" AUTOMATIC_TAGGING: true diff --git a/README.md b/README.md index 5971dcc4..5f36515f 100644 --- a/README.md +++ b/README.md @@ -23,8 +23,6 @@ Create the next environment vars in your repository: **Please Note:** The Teamwork account associated with this API key is the account which these comments will be created under. If this user does not have permission to access a task's project, that task will be skipped and the workflow run will be marked as failed. -`GITHUB_TOKEN` doesn't need to be setup in the repository, this var is always available during the workflows execution. - ### Installation Create a new file `/.github/workflows/teamwork.yml` with the following: @@ -44,7 +42,6 @@ jobs: steps: - uses: teamwork/github-sync@master with: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} TEAMWORK_URI: ${{ secrets.TEAMWORK_URI }} TEAMWORK_API_TOKEN: ${{ secrets.TEAMWORK_API_TOKEN }} AUTOMATIC_TAGGING: false diff --git a/action.yml b/action.yml index 014a25f7..16713039 100644 --- a/action.yml +++ b/action.yml @@ -5,8 +5,9 @@ branding: color: 'gray-dark' inputs: GITHUB_TOKEN: - description: 'GitHub token' - required: true + description: 'Deprecated, no longer used.' + required: false + default: '' TEAMWORK_URI: description: 'Teamwork URI' required: true diff --git a/src/main.sh b/src/main.sh index f7312623..caa0a618 100644 --- a/src/main.sh +++ b/src/main.sh @@ -14,7 +14,7 @@ main() { ensure::env_variable_exist "GITHUB_EVENT_PATH" ensure::env_variable_exist "GITHUB_EVENT_NAME" - export GITHUB_TOKEN="$1" + # $1 used to be GITHUB_TOKEN, which was never needed. export TEAMWORK_URI="$2" export TEAMWORK_API_TOKEN="$3" export AUTOMATIC_TAGGING="$4" From aecde292fd78f076ee43242a4870308c37e08198 Mon Sep 17 00:00:00 2001 From: Marc Izquierdo Date: Tue, 20 Oct 2026 19:58:29 +0200 Subject: [PATCH 2/2] Read the Teamwork token from its INPUT_ env var Passing secrets in runs.args put them on the docker run command line, where other processes on the runner can read them; GitHub only masks them in the logs. The runner already gives the container every input as an INPUT_* env var, passed by name only, so read the token from there and leave the secrets' args slots empty. Co-Authored-By: Claude Opus 5.5 --- action.yml | 9 ++++++--- src/main.sh | 6 ++++-- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/action.yml b/action.yml index 16713039..738df59e 100644 --- a/action.yml +++ b/action.yml @@ -48,10 +48,13 @@ inputs: runs: using: 'docker' image: 'Dockerfile' + # Secrets stay out of args, which show up in the runner's process list. The + # Teamwork token is read from its INPUT_TEAMWORK_API_TOKEN env var instead, + # and the empty slots keep the other args in place. args: - - ${{ inputs.GITHUB_TOKEN }} + - '' - ${{ inputs.TEAMWORK_URI }} - - ${{ inputs.TEAMWORK_API_TOKEN }} + - '' - ${{ inputs.AUTOMATIC_TAGGING }} - ${{ inputs.WORKFLOW_STAGE_OPENED }} - ${{ inputs.WORKFLOW_STAGE_MERGED }} @@ -59,4 +62,4 @@ runs: - ${{ inputs.LIGHTWEIGHT_COMMENT }} - ${{ inputs.BOARD_COLUMN_OPENED }} - ${{ inputs.BOARD_COLUMN_MERGED }} - - ${{ inputs.BOARD_COLUMN_CLOSED }} \ No newline at end of file + - ${{ inputs.BOARD_COLUMN_CLOSED }} diff --git a/src/main.sh b/src/main.sh index caa0a618..e1db5e0d 100644 --- a/src/main.sh +++ b/src/main.sh @@ -14,9 +14,11 @@ main() { ensure::env_variable_exist "GITHUB_EVENT_PATH" ensure::env_variable_exist "GITHUB_EVENT_NAME" - # $1 used to be GITHUB_TOKEN, which was never needed. + # $1 used to be GITHUB_TOKEN, which was never needed. The Teamwork token comes + # from the env var GitHub creates for the input, so it isn't on the command + # line; $3 is the fallback for running the image by hand. export TEAMWORK_URI="$2" - export TEAMWORK_API_TOKEN="$3" + export TEAMWORK_API_TOKEN="${INPUT_TEAMWORK_API_TOKEN:-$3}" export AUTOMATIC_TAGGING="$4" export WORKFLOW_STAGE_OPENED="$5" export WORKFLOW_STAGE_MERGED="$6"