CalvinBackup/anonymous_github
1
0
Fork 0
mirror of https://github.com/tdurieux/anonymous_github.git synced 2026-09-29 05:31:43 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: revalidate scoped public tokens throughout repository reads

Browse Source
This commit is contained in:
Thomas Durieux
2026-09-13 15:16:45 +00:00
parent 5e5cc6e0c2
commit dc026e2ee8
3 changed files with 91 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/github-app-setup.md
+3 -1
View File
@@ -101,7 +101,9 @@ so users can paste a public URL without installing the App on its owner account.
The connection records the repository ID and verifies that the stored source
name still resolves to that ID with public visibility on each source access.
Private and Enterprise-internal repositories require an installation with access.
Long API traversals renew the App user token under the same user quota.
Public reads use a [repository-scoped App user token](https://docs.github.com/en/rest/apps/apps#create-a-scoped-access-token) with read-only permissions.
Each API request renews through its own repository binding, rechecking identity
and public visibility while keeping the same user quota.
Existing installation bindings retain their installation checks.
This uses GitHub's documented [public resource access for App user tokens](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/choosing-permissions-for-a-github-app).