You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Removing the automatic merge and requiring PRs instead could work but I would favour changing the token so that it's provided by a GitHub App. This is fetched at runtime and doesn't require any secrets to be stored.
Repository settings can then be configured so that only the App (bot) user is allowed to make commits without a PR and approvals. The App user could also be set as the committer.
The release pipeline should be tidied up, release branches could be removed and replaced with tagging the master branch.
Additionally, a lot of the release pipelines rely on an admin's GitHub token in order to commit to protected branches:
Gaffer/.github/workflows/release.yaml
Line 31 in b2bca5e
Ideally this would be replaced with PRs perhaps, and the
ADMIN_GITHUB_TOKEN
removed.The text was updated successfully, but these errors were encountered: