Keep secrets out of the container's command line

.github/workflows/test.yml

@@ -13,7 +13,6 @@ jobs:
       - uses: actions/checkout@v5
       - uses: ./
         with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TEAMWORK_URI: "localhost"
           TEAMWORK_API_TOKEN: "test_api_token"
           AUTOMATIC_TAGGING: true

README.md

@@ -23,8 +23,6 @@ Create the next environment vars in your repository:
 
 **Please Note:** The Teamwork account associated with this API key is the account which these comments will be created under. If this user does not have permission to access a task's project, that task will be skipped and the workflow run will be marked as failed.
 
-`GITHUB_TOKEN` doesn't need to be setup in the repository, this var is always available during the workflows execution.
-
 ### Installation
 Create a new file `/.github/workflows/teamwork.yml` with the following:
 
@@ -44,7 +42,6 @@ jobs:
     steps:
       - uses: teamwork/github-sync@master
         with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TEAMWORK_URI: ${{ secrets.TEAMWORK_URI }}
           TEAMWORK_API_TOKEN: ${{ secrets.TEAMWORK_API_TOKEN }}
           AUTOMATIC_TAGGING: false

action.yml

@@ -5,8 +5,9 @@ branding:
   color: 'gray-dark'
 inputs:
   GITHUB_TOKEN:
-    description: 'GitHub token'
-    required: true
+    description: 'Deprecated, no longer used.'
+    required: false
+    default: ''
   TEAMWORK_URI:
     description: 'Teamwork URI'
     required: true
@@ -47,15 +48,18 @@ inputs:
 runs:
   using: 'docker'
   image: 'Dockerfile'
+  # Secrets stay out of args, which show up in the runner's process list. The
+  # Teamwork token is read from its INPUT_TEAMWORK_API_TOKEN env var instead,
+  # and the empty slots keep the other args in place.
   args:
-    - ${{ inputs.GITHUB_TOKEN }}
+    - ''
     - ${{ inputs.TEAMWORK_URI }}
-    - ${{ inputs.TEAMWORK_API_TOKEN }}
+    - ''
     - ${{ inputs.AUTOMATIC_TAGGING }}
     - ${{ inputs.WORKFLOW_STAGE_OPENED }}
     - ${{ inputs.WORKFLOW_STAGE_MERGED }}
     - ${{ inputs.WORKFLOW_STAGE_CLOSED }}
     - ${{ inputs.LIGHTWEIGHT_COMMENT }}
     - ${{ inputs.BOARD_COLUMN_OPENED }}
     - ${{ inputs.BOARD_COLUMN_MERGED }}
-    - ${{ inputs.BOARD_COLUMN_CLOSED }}
+    - ${{ inputs.BOARD_COLUMN_CLOSED }}

src/main.sh

@@ -14,9 +14,11 @@ main() {
   ensure::env_variable_exist "GITHUB_EVENT_PATH"
   ensure::env_variable_exist "GITHUB_EVENT_NAME"
 
-  export GITHUB_TOKEN="$1"
+  # $1 used to be GITHUB_TOKEN, which was never needed. The Teamwork token comes
+  # from the env var GitHub creates for the input, so it isn't on the command
+  # line; $3 is the fallback for running the image by hand.
   export TEAMWORK_URI="$2"
-  export TEAMWORK_API_TOKEN="$3"
+  export TEAMWORK_API_TOKEN="${INPUT_TEAMWORK_API_TOKEN:-$3}"
   export AUTOMATIC_TAGGING="$4"
   export WORKFLOW_STAGE_OPENED="$5"
   export WORKFLOW_STAGE_MERGED="$6"