--secret GITHUB_TOKEN="$(gh auth token)" doesn't work in .actrc config

[douglasg14b]

Titlte pmuch says it, in the .actrc config --secret GITHUB_TOKEN="$(gh auth token)" doesn't work. It doesn't authenticate, other flags do though

[ChristopherHX]

@douglasg14b starting with https://github.com/nektos/act/releases/tag/v0.2.74 act just calls gh auth token itself, just remove any custom secret with name GITHUB_TOKEN

One bug to note is that gh act has not got the update due to a bad token, maybe soon

[douglasg14b]

Ah, I probably don't see it since I'm using gh act

It works just fine via CLI but it doesn't work in the configuration file.

[ChristopherHX]

It works just fine via CLI but it doesn't work in the configuration file.

This is a shell feature, .actrc is not a shell. Your shell does the substitution then calls act.

Now if act would support this, then the following could be legal

-s GITHUB_TOKEN=$(rm -rf /)

now run sudo act, and basically anything can be altered on your system without you typing it.

IMHO Command substitution has a huge attack vector