From 05f0f37a6001dbda5df12f8a448d179cb864851b Mon Sep 17 00:00:00 2001 From: Jason Song Date: Fri, 6 Jan 2023 13:34:38 +0800 Subject: [PATCH] Clone actions without token (#6) Shouldn't provide token when cloning actions, the token comes from the instance which triggered the task, it might be not the instance which provides actions. For GitHub, they are the same, always github.com. But for Gitea, tasks triggered by a.com can clone actions from b.com. Reviewed-on: https://gitea.com/gitea/act/pulls/6 Reviewed-by: Lunny Xiao Co-authored-by: Jason Song Co-committed-by: Jason Song --- act/runner/step_action_remote.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/act/runner/step_action_remote.go b/act/runner/step_action_remote.go index 26b178e7..264b0600 100644 --- a/act/runner/step_action_remote.go +++ b/act/runner/step_action_remote.go @@ -64,7 +64,13 @@ func (sar *stepActionRemote) prepareActionExecutor() common.Executor { URL: sar.remoteAction.CloneURL(), Ref: sar.remoteAction.Ref, Dir: actionDir, - Token: github.Token, + Token: "", /* + Shouldn't provide token when cloning actions, + the token comes from the instance which triggered the task, + however, it might be not the same instance which provides actions. + For GitHub, they are the same, always github.com. + But for Gitea, tasks triggered by a.com can clone actions from b.com. + */ }) var ntErr common.Executor if err := gitClone(ctx); err != nil {