undefined | Better HN

0 pointswoodruffw5mo ago0 comments

Private repos aren't as much of a concern, for obvious reasons.

However, it's worth noting that you don't (necessarily) need `pull_request_target` for the OIDC credential in a private repo: all first-party PRs will get it with the `pull_request` event. You can configure the subject for that credential with whatever components you want to make it deterministic.

0 comments

lijok5mo ago

You’re right! I edited my comment to clarify I was talking about good ole job_workflow_ref.

j / k navigate · click thread line to collapse

0 pointswoodruffw5mo ago0 comments

Private repos aren't as much of a concern, for obvious reasons.

0 comments

lijok5mo ago

You’re right! I edited my comment to clarify I was talking about good ole job_workflow_ref.

j / k navigate · click thread line to collapse