using embedded GITHUB_TOKEN for insiders?

[hellt]

Hi @squidfunk
I am going through the materials-insiders installation with git procedure and it uses a PAT to create packages.

Maybe we can simplify that by using the always available GITHUB_TOKEN secret with ghcr as recommended here - https://github.com/docker/login-action#github-container-registry?

[squidfunk]

Is that new? Documentation seems to be here. Would you like to craft a PR?

[kcgthb]

The GITHUB_TOKEN can only access the repository that contains the workflow file, apparently. So I'm not sure it can be used to access other private repositories.

From https://docs.github.com/en/actions/security-guides/automatic-token-authentication#about-the-github_token-secret :

The token's permissions are limited to the repository that contains your workflow.

[hellt]

@kcgthb you don't access any repositories, but your own, right? you have the fork, that is where the workflow is run

[squidfunk]

You should be able to use the GITHUB_TOKEN for access from your Insiders fork itself, but most users are not forking Insiders, which is why we provide a canonical way that works with all setups in the documentation. As with everything that is written in the docs – YMMV and there are almost always alternative approaches to achieve the same thing. Keeping it low-friction for non- or low-tech users is a priority.

[squidfunk]

I'm marking this comment as the answer to the issue, as it includes several hints why we're not advertising this on the docs.

[hellt]

ah, yes, I was referring specifically to the docker-based installation. In that case you must fork a repo, and then the requirement of creating a PAT can be lifted