Conversation
bjohansebas
force-pushed
the
pinojs
branch
2 times, most recently
from
7b6257f to
7c73879
Compare
|
New dependencies detected. Learn more about Socket for GitHub ↗︎
|
| const start = new Date().getTime() | ||
| const { stdout, stderr } = await exec(`docker run -e GITHUB_AUTH_TOKEN=${process.env.GITHUB_TOKEN} --rm ${ossfScorecardSettings.dockerImage} --repo=${repo.html_url} --show-details --format=json`) | ||
| if (stderr) { | ||
| console.error(stderr) |
There was a problem hiding this comment.
It is not possible to parse a string, so the best option would be to remove this to prevent a token leak.
Or maybe I haven't found the option yet.
There was a problem hiding this comment.
I know there is redact to do that, but it only works at the object level, or that's the only way it has worked correctly for me.
There was a problem hiding this comment.
You are totally right! Let me see if I can use a hook for this, as the token pattern is clear.
|
Is there any reason why the CI is not running? |
I was using a preview version an seems like there is a bug https://github.com/orgs/community/discussions/143787#discussioncomment-11593095. The CI is passing now 👍 |
2 participants
fixes: #132