Authentication with repository API tokens is unsafe for PR builds

[reviewdog]

Authentication with repository API tokens is unsafe for PR builds

[haya14busa]

Yes, It's actually one of the big troublesome problems for reviewdog to recommend users to use it for OSS projects.

One minor correction: many CI services treated PR from forked repo as untrusted code and do not pass secret env var, but PR from same repo can use secret vars.

You might be interested in GitHub Actions because they provide GITHUB_TOKEN which has read/write access for PR from the same repo and has only read access from forked repo.

github-pr-check reporter currently fallback to use GitHub Actions log console as output target if p-r is from forked repo.
github-pr-review reporter can use the similar strategy if you don't like check report but I didn't work on supporting it.
https://github.com/reviewdog/reviewdog#option-1-run-reviewdog-from-github-actions-w-secretsgithub_token-experimental

[haya14busa]

This release solved the problem for GitHub Actions. https://github.com/reviewdog/reviewdog/releases/tag/v0.9.15

[friday]

Thanks for the info and correction 👍 I'll likely look into this at some point but I'm short of time currently.

If you think there's nothing to act on in this issue feel free to close it.