Skip to content

[Security Issue] Update README.md to recommend removing auth.json after use #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 25, 2021
Merged

[Security Issue] Update README.md to recommend removing auth.json after use #64

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,7 +208,7 @@ It's recommended to use SSH keys for authentication, but sometimes HTTP basic au
}
```

3) Pass this secret to auth.json as a separate action step within your Yaml config:
3) Pass this secret to auth.json as a separate action step within your Yaml config, and remove auth.json to prevent deploying it:

```yaml
jobs:
Expand All @@ -221,6 +221,9 @@ jobs:

- name: Install dependencies
uses: php-actions/composer@v6

- name: Remove auth.json file
run: rm -f $GITHUB_WORKSPACE/auth.json
```

4) Now, any connections Composer makes to Github.com will use your HTTP basic auth credentials, which is essentially the same as being logged in as you, so your private repositories will now be available to Composer.
Expand Down