Skip to content

Remove invalid expression default from GITHUB_TOKEN input#8

Merged
tarmojussila merged 1 commit intomainfrom
bugfix/action-invalid-token-default
Feb 22, 2026
Merged

Remove invalid expression default from GITHUB_TOKEN input#8
tarmojussila merged 1 commit intomainfrom
bugfix/action-invalid-token-default

Conversation

@tarmojussila
Copy link
Owner

Expressions like ${{ github.token }} are not evaluated in action.yml inputs. The token is already available via process.env.GITHUB_TOKEN in the action code as a fallback.

Expressions like ${{ github.token }} are not evaluated in action.yml
inputs. The token is already available via process.env.GITHUB_TOKEN
in the action code as a fallback.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@github-actions
Copy link

Z.ai Code Review

Review Feedback

1. Potential Breaking Change & DX Regression
Removing the default value for GITHUB_TOKEN creates a breaking change for any workflows currently using this action without explicitly passing the token.

  • Impact: Users will now receive an empty string/undefined for this input, likely causing API calls to fail (401 Unauthorized).
  • Recommendation: Unless there is a strict security reason to force explicit manual configuration, keep default: ${{ github.token }}. It significantly improves developer experience by reducing boilerplate setup.

2. Missing Input Validation
Since the input is now required: false and has no default, the action code must explicitly handle cases where the token is missing.

  • Risk: The code likely attempts to authenticate with the GitHub API immediately. If the input is an empty string, the application may throw an unhandled exception or cryptic error.
  • Action: Ensure dist/index.js checks if GITHUB_TOKEN is populated before use and provides a clear error message (e.g., "GITHUB_TOKEN is required for this action to run") if it is missing.

@tarmojussila tarmojussila merged commit 6c973ff into main Feb 22, 2026
1 check passed
@tarmojussila tarmojussila deleted the bugfix/action-invalid-token-default branch February 22, 2026 16:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant