Update recommendations on GitHub token usage, pushing users towards fine-grained tokens #12553
Conversation
…ine-grained tokens
|
Test failures seem to have other causes |
|
Maybe we can additionally clarify that the private repo use case only applies when Composer needs to load data for such repositories that are configured as When private repos are tracked through e. g. Satis (or probably Private Packagist?) and cloned through SSH URLs, a public-only (no-scope) token should be enough, not? |
Yes, if you use Private Packagist and just use zip/dists, you should not need any GitHub token at all locally.. For source installs then yeah ssh should be enough. If you want to edit feel free but otherwise I am happy to merge as is. Just let me know :) |
The recent events in the NPM ecosystem reminded us all of how important it is to keep access tokens for services like GitHub, NPM etc. secure.
So, let's occupy some more screen estate and push developers to more carefully decide which kind of GitHub token is really necessary for their use case.