From 5ac83f22ac0a28351d303f85b86e5f174f6cd80c Mon Sep 17 00:00:00 2001 From: reinkrul Date: Tue, 13 Oct 2026 15:30:42 +0200 Subject: [PATCH] ci(e2e): use GITHUB_TOKEN instead of personal access token (#4630) PACKAGE_SECRET (a maintainer's PAT) was passed as an unused Docker build secret and used for ghcr package cleanup. GITHUB_TOKEN with packages: write handles the cleanup, so drop the PAT. The dependabot-only steps never ran (github.actor is 'dependabot[bot]', not 'dependabot'), so remove them. Assisted by AI --- .github/workflows/e2e-tests.yaml | 26 -------------------------- 1 file changed, 26 deletions(-) diff --git a/.github/workflows/e2e-tests.yaml b/.github/workflows/e2e-tests.yaml index 90ad929283..3093e149eb 100644 --- a/.github/workflows/e2e-tests.yaml +++ b/.github/workflows/e2e-tests.yaml @@ -52,19 +52,6 @@ jobs: - name: Build and push uses: docker/build-push-action@v6 - if: ${{ github.actor != 'dependabot' }} - with: - context: . - file: Dockerfile - platforms: linux/amd64 - push: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }} - tags: ghcr.io/nuts-foundation/nuts-node-ci:${{ env.SHA }} - secrets: | - GIT_AUTH_TOKEN=${{ secrets.PACKAGE_SECRET }} - - - name: Build and push dependabot - uses: docker/build-push-action@v6 - if: ${{ github.actor == 'dependabot' }} with: context: . file: Dockerfile @@ -82,21 +69,8 @@ jobs: - name: package cleanup uses: dataaxiom/ghcr-cleanup-action@v1 continue-on-error: true # action doesn't fail when this step fails - if: ${{ github.actor != 'dependabot' }} - with: - owner: nuts-foundation - package: nuts-node-ci - # NOTE: using Personal Access Token - token: ${{ secrets.PACKAGE_SECRET }} - keep-n-tagged: 3 - - - name: package cleanup dependabot - uses: dataaxiom/ghcr-cleanup-action@v1 - continue-on-error: true # action doesn't fail when this step fails - if: ${{ github.actor == 'dependabot' }} with: owner: nuts-foundation package: nuts-node-ci - # NOTE: using Personal Access Token token: ${{ secrets.GITHUB_TOKEN }} keep-n-tagged: 3