Heretek-Games/flatpark
1
0
Fork 0
mirror of https://github.com/Heretek-Games/flatpark.git synced 2026-10-11 20:59:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: PAT lifecycle notes — no-expiration option, idle deletion, GitHub App as long-term fix

Browse Source 
Co-Authored-By: Claude Fable 5 <[email protected]>
This commit is contained in:
Komh
2026-07-12 10:32:33 +08:00
co-authored by Claude Fable 5
parent c6fc3e1db3
commit 3d4c7fd281
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/publish-action-launch.md
+10 -2
View File
@@ -59,8 +59,16 @@ wrangler deploy # custom_domain route creates the DNS recor
The PAT: GitHub → Settings → Developer settings → Fine-grained tokens →
scope **only flatpark/flatpark**, permission **Contents: read and write**
(that's what `repository_dispatch` requires), long expiry. Public-repo read
(default) also covers the upstream release-existence check.
(that's what `repository_dispatch` requires), expiration **No expiration**
(fine-grained tokens allow it unless an org policy caps lifetime). Public-repo
read (default) also covers the upstream release-existence check. Two lifecycle
caveats: GitHub deletes PATs unused for a full year (a dispatch-only token on
a quiet catalog could conceivably idle that long), and if the token ever dies
the blast radius is every adopter's release workflow failing our step — which
is why the action README tells upstreams to set `continue-on-error: true`,
and the daily cron delivers the update either way. Long-term the clean fix is
a GitHub App (the Worker mints 1-hour installation tokens on demand; nothing
to rotate or expire).
Smoke-test the deployed Worker: