feat: add optional github-token input to generate_terraform_docs workflow#967
Open
jansdhillon wants to merge 4 commits intocanonical:mainfrom
Open
feat: add optional github-token input to generate_terraform_docs workflow#967jansdhillon wants to merge 4 commits intocanonical:mainfrom
github-token input to generate_terraform_docs workflow#967jansdhillon wants to merge 4 commits intocanonical:mainfrom
Conversation
…flow Adds an optional github-token input that defaults to secrets.GITHUB_TOKEN for backwards compatibility. Callers can pass a PAT to allow CI workflows to trigger on the resulting pull request. Fixes canonical#966
f552989 to
f4b2b3b
Compare
yanksyoon
reviewed
Mar 10, 2026
Comment on lines
+16
to
+19
| github-token: | ||
| type: string | ||
| description: Token used to create the pull request. Use a PAT to allow CI to trigger on the resulting PR. | ||
| default: "" |
Member
There was a problem hiding this comment.
Hello! Im afraid this would lead to a secrets leak (security issue), would you try inheriting the secret instead? https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows#using-inputs-and-secrets-in-a-reusable-workflow
Contributor
There was a problem hiding this comment.
I agree with Yanks on this.
Author
There was a problem hiding this comment.
Hi, I've changed it to a secrets block instead
Move github-token from workflow_call inputs (string) to workflow_call secrets to prevent potential token exposure in workflow logs. Fixes canonical#966
202cd33 to
1bcee9a
Compare
Contributor
Test results for commit 1bcee9aTest coverage for 1bcee9a Static code analysis report |
Contributor
Test results for commit 1bcee9aTest coverage for 1bcee9a Static code analysis report |
Contributor
Test results for commit 1bcee9aTest coverage for 1bcee9a Static code analysis report |
alithethird
approved these changes
Mar 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applicable spec: #966
Overview
Adds an optional
github-tokeninput to thegenerate_terraform_docsworkflow so callers can supply a PAT instead of the defaultGITHUB_TOKEN.Rationale
GitHub prevents workflows from being triggered by commits or PRs created using
GITHUB_TOKEN. This means that whenterraform-docsopens or updates a PR, no CI workflows run against it. By allowing callers to pass a PAT, CI can be triggered on the resulting PR.Workflow Changes
github-tokeninput (type:string, default:"") togenerate_terraform_docs.yamlunderworkflow_call.inputs.Create pull requeststep to use${{ inputs.github-token || secrets.GITHUB_TOKEN }}, preserving backwards compatibility.Checklist
urgent,trivial,complex) - pls tagtrivial