Provide an input for github tokens (#172)

* Provide an input for github tokens

- By providing an input for github tokens with a default users no longer have to pass
  the github token via their environment across workflows.
- Remove GITHUB_TOKEN from our environment in all workflows

* Don't run workflows on main on pull requests

Co-authored-by: Paulo F. Oliveira <paulo.ferraz.oliveira@gmail.com>

.github/workflows/action.yml

@@ -6,11 +6,7 @@ on:
     branches:
       - main
   pull_request:
-    branches:
-      - main
-
-env:
-  GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+    types: [opened, synchronize]
 
 jobs:
   check_integrity:

.github/workflows/ubuntu.yml

@@ -6,11 +6,7 @@ on:
     branches:
       - main
   pull_request:
-    branches:
-      - main
-
-env:
-  GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+    types: [opened, synchronize]
 
 jobs:
   integration_test:

.github/workflows/update_3rd_party_licenses.yml

@@ -17,5 +17,3 @@ jobs:
           node-version: '14'
       - run:
           ./.github/workflows/update_3rd_party_licenses.sh
-        env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

.github/workflows/windows.yml

@@ -6,11 +6,7 @@ on:
     branches:
       - main
   pull_request:
-    branches:
-      - main
-
-env:
-  GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+    types: [opened, synchronize]
 
 jobs:
   integration_test:

action.yml

@@ -8,6 +8,15 @@ branding:
   color: blue
   icon: code
 inputs:
+  github-token:
+    description: >
+      A GitHub token used to access the GitHub REST API for retrieving release and version information.
+      While this action will never perform anything more than read operations against the GitHub REST API,
+      we do not recommend providing a self-generated personal access token which may provide more access than is
+      required of this action. This input instead is merely a convenience so that users of this action do not
+      have to manually pass an automatically generated token via their environment settings within a workflow.
+      [Learn more about automatically generated tokens](https://docs.github.com/en/actions/security-guides/automatic-token-authentication)
+    default: ${{ github.token }}
   otp-version:
     description: Version range or exact version of Erlang/OTP to use,
       or false when installing only Gleam without OTP

dist/index.js

@@ -7612,9 +7612,12 @@ async function get(url0, pageIdxs) {
       const headers = {
         'user-agent': 'setup-beam',
       }
-      if (process.env.GITHUB_TOKEN) {
-        headers.authorization = `Bearer ${process.env.GITHUB_TOKEN}`
+      const GithubToken = getInput('github-token', false)
+
+      if (GithubToken) {
+        headers.authorization = `Bearer ${GithubToken}`
       }
+
       if (pageIdx !== null) {
         url.searchParams.append('page', pageIdx)
       }

src/setup-beam.js

@@ -419,9 +419,12 @@ async function get(url0, pageIdxs) {
       const headers = {
         'user-agent': 'setup-beam',
       }
-      if (process.env.GITHUB_TOKEN) {
-        headers.authorization = `Bearer ${process.env.GITHUB_TOKEN}`
+      const GithubToken = getInput('github-token', false)
+
+      if (GithubToken) {
+        headers.authorization = `Bearer ${GithubToken}`
       }
+
       if (pageIdx !== null) {
         url.searchParams.append('page', pageIdx)
       }