chore(ci): update sha for podman-install action - #594
Open
danivilla9 wants to merge 6 commits into
Open
Conversation
Signed-off-by: Daniel Villanueva <davillan@redhat.com>
📝 WalkthroughWalkthroughThe Podman nightly action now accepts an optional GitHub token, validates the download URL, and masks the token in command logs. Windows E2E workflows update version-fetch pins, pass token and provider inputs, and document or select nightly versions. ChangesWindows Podman nightly downloads
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/desktop-e2e-podman-windows-matrix.yaml:
- Line 79: Update the download-podman-nightly composite action to accept an
installer-path input and use the local MSI when download_url is empty, while
preserving the existing podman-download-url behavior. Add coverage for both
nightly and main installation paths, including the local-installer fallback.
In @.github/workflows/desktop-e2e-test-job-windows.yaml:
- Line 76: Update the Windows Podman setup workflow around the
fetch-latest-podman-version-windows step to pass its local_installer_path output
through the downloader, while preserving download_url handling for non-nightly
versions. Add or update the nightly/main-path test to verify the local installer
path is forwarded and used when download_url is empty.
In @.github/workflows/podman-desktop-e2e-kubernetes.yaml:
- Line 74: Update the Windows Podman setup around the fetch-podman step and
download-podman-nightly invocation to pass the action’s installer-path output
instead of download_url. Add a condition or validation for nightly/main runs so
the installer path is populated before download-podman-nightly executes.
In @.github/workflows/podman-desktop-e2e-nightly-windows-wsl.yaml:
- Line 75: Update the workflow’s Podman installation handoff so nightly/main
runs use the installer path produced by fetch-latest-podman-version-windows via
local_installer_path instead of the empty download_url; preserve the existing
URL path for non-nightly runs, and add coverage validating the nightly dispatch
passes the local installer to download-podman-nightly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 81fd1058-3a3f-4633-aa3f-880987572bf9
📒 Files selected for processing (8)
.github/workflows/desktop-e2e-podman-windows-matrix.yaml.github/workflows/desktop-e2e-test-job-windows.yaml.github/workflows/podman-desktop-e2e-kubernetes.yaml.github/workflows/podman-desktop-e2e-nightly-windows-hyperv.yaml.github/workflows/podman-desktop-e2e-nightly-windows-wsl.yaml.github/workflows/podman-desktop-e2e-remote-windows.yaml.github/workflows/podman-desktop-e2e-stress-ui-windows.yaml.github/workflows/prerelease-desktop-e2e-debug-job-windows.yaml
Signed-off-by: Daniel Villanueva <davillan@redhat.com>
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/podman-desktop-e2e-nightly-windows-hyperv.yaml (1)
80-82: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winUpdate the default Podman version to
nightly.In the
podman-desktop-e2e-nightly-windows-wsl.yamlworkflow, theversion_inputfallback was updated to'nightly'to properly test the nightly bits. It appears this update was missed in this Hyper-V equivalent workflow (it currently falls back to'latest'on line 84).Please consider updating it to
'nightly'for consistency and correct nightly testing behavior. You may also want to verify if theworkflow_dispatchinput descriptions at the top of the file need the same update as the WSL workflow.💻 Proposed fix
- name: Fetch latest Podman version id: fetch-podman uses: redhat-actions/podman-install/.github/actions/fetch-latest-podman-version-windows@60b05ab5b050c9f8ec8dff7e0377f8bf36c39207 with: - version_input: ${{ github.event.inputs.podman_version || 'latest' }} + version_input: ${{ github.event.inputs.podman_version || 'nightly' }} file_type: 'msi'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/podman-desktop-e2e-nightly-windows-hyperv.yaml around lines 80 - 82, Update the Hyper-V workflow’s Podman version fallback associated with fetch-podman from latest to nightly, matching the WSL nightly workflow. Also align the workflow_dispatch input description or default with the nightly value where applicable.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/download-podman-nightly/action.yml:
- Around line 111-114: Update the user-level Path handling in the Podman
installation step so an unset or null $currentUserPath is treated as empty
before calling .Contains(). Preserve the existing behavior of avoiding duplicate
$podmanPath entries and appending the path for accounts with an existing
user-level Path.
---
Outside diff comments:
In @.github/workflows/podman-desktop-e2e-nightly-windows-hyperv.yaml:
- Around line 80-82: Update the Hyper-V workflow’s Podman version fallback
associated with fetch-podman from latest to nightly, matching the WSL nightly
workflow. Also align the workflow_dispatch input description or default with the
nightly value where applicable.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 40902de9-fdb9-40fe-be2d-c0573689ba3f
📒 Files selected for processing (9)
.github/actions/download-podman-nightly/action.yml.github/workflows/desktop-e2e-podman-windows-matrix.yaml.github/workflows/desktop-e2e-test-job-windows.yaml.github/workflows/podman-desktop-e2e-kubernetes.yaml.github/workflows/podman-desktop-e2e-nightly-windows-hyperv.yaml.github/workflows/podman-desktop-e2e-nightly-windows-wsl.yaml.github/workflows/podman-desktop-e2e-remote-windows.yaml.github/workflows/podman-desktop-e2e-stress-ui-windows.yaml.github/workflows/prerelease-desktop-e2e-debug-job-windows.yaml
Signed-off-by: Daniel Villanueva <davillan@redhat.com>
odockal
requested changes
Jul 15, 2026
danivilla9
marked this pull request as draft
July 16, 2026 10:55
This was referenced Aug 10, 2026
Pin fetch-latest-podman-version-windows to the addendum SHA that exposes archive_download_url via download_url, and resolve authenticated Actions artifacts on the runner before installing on Windows. Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Daniel Villanueva <davillan@redhat.com>
Pass archive_download_url and githubToken through to podman.ps1 so the Windows host downloads Actions artifacts the same way as release MSIs. Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Daniel Villanueva <davillan@redhat.com>
Remove actions:read added for nightly artifact access (it only applies to this repo) and newly introduced contents:read-only permission blocks. Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Daniel Villanueva <davillan@redhat.com>
danivilla9
force-pushed
the
586-update-sha-podman-install-action
branch
from
August 11, 2026 10:57
6981fe5 to
25ee6db
Compare
danivilla9
marked this pull request as ready for review
August 11, 2026 10:57
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/actions/download-podman-nightly/action.yml (1)
65-107: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRemove shell evaluation from the download command.
The upstream fetch action accepts a full URL as
version_input. A valid URL can include query parameters. Direct interpolation at Line 65 andevalat Line 107 can execute shell syntax from that URL or split the command at&. This can fail valid custom URL runs and can execute injected shell commands on the runner. (raw.githubusercontent.com)Pass
podman-download-urlthroughenv, constructCMDas a Bash array, log it withprintf '%q ', and execute it with"${CMD[@]}". Do not useeval.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/actions/download-podman-nightly/action.yml around lines 65 - 107, The download command block must avoid shell evaluation and preserve URLs containing query parameters. Pass podman-download-url through the step environment, build CMD as a Bash array so each argument remains separate, log the array using printf '%q ', and execute it with "${CMD[@]}"; remove string concatenation and eval while preserving the provider, WSL, and GitHub token options.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/podman-desktop-e2e-nightly-windows-wsl.yaml:
- Around line 138-139: Replace the repository-scoped GITHUB_TOKEN used by both
github_token and github-token in all eight
workflows—.github/workflows/podman-desktop-e2e-nightly-windows-wsl.yaml
(138-139), .github/workflows/desktop-e2e-test-job-windows.yaml (138-139),
.github/workflows/podman-desktop-e2e-kubernetes.yaml (130-131),
.github/workflows/podman-desktop-e2e-nightly-windows-hyperv.yaml (144-145),
.github/workflows/podman-desktop-e2e-remote-windows.yaml (162-163),
.github/workflows/podman-desktop-e2e-stress-ui-windows.yaml (156-157),
.github/workflows/prerelease-desktop-e2e-debug-job-windows.yaml (178-179), and
.github/workflows/desktop-e2e-podman-windows-matrix.yaml (145-146)—with a
configured GitHub App or fine-grained token having Actions: read access to
podman-container-tools/podman.
---
Outside diff comments:
In @.github/actions/download-podman-nightly/action.yml:
- Around line 65-107: The download command block must avoid shell evaluation and
preserve URLs containing query parameters. Pass podman-download-url through the
step environment, build CMD as a Bash array so each argument remains separate,
log the array using printf '%q ', and execute it with "${CMD[@]}"; remove string
concatenation and eval while preserving the provider, WSL, and GitHub token
options.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 3bdfe11b-584d-4a8d-b982-a27c2a8d4658
📒 Files selected for processing (9)
.github/actions/download-podman-nightly/action.yml.github/workflows/desktop-e2e-podman-windows-matrix.yaml.github/workflows/desktop-e2e-test-job-windows.yaml.github/workflows/podman-desktop-e2e-kubernetes.yaml.github/workflows/podman-desktop-e2e-nightly-windows-hyperv.yaml.github/workflows/podman-desktop-e2e-nightly-windows-wsl.yaml.github/workflows/podman-desktop-e2e-remote-windows.yaml.github/workflows/podman-desktop-e2e-stress-ui-windows.yaml.github/workflows/prerelease-desktop-e2e-debug-job-windows.yaml
Comment on lines
+138
to
+139
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| podman-provider: ${{ env.PODMAN_PROVIDER }} |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
files=(
.github/workflows/podman-desktop-e2e-nightly-windows-wsl.yaml
.github/workflows/desktop-e2e-test-job-windows.yaml
.github/workflows/podman-desktop-e2e-kubernetes.yaml
.github/workflows/podman-desktop-e2e-nightly-windows-hyperv.yaml
.github/workflows/podman-desktop-e2e-remote-windows.yaml
.github/workflows/podman-desktop-e2e-stress-ui-windows.yaml
.github/workflows/prerelease-desktop-e2e-debug-job-windows.yaml
.github/workflows/desktop-e2e-podman-windows-matrix.yaml
)
printf '%s\n' '=== Referenced workflow files ==='
git ls-files -- "${files[@]}"
printf '%s\n' '=== Relevant action invocations and token definitions ==='
for file in "${files[@]}"; do
echo "--- $file"
rg -n -C 8 \
'fetch-latest-podman-version-windows|download-podman-nightly|github-token:|github_token:|PODMAN_PROVIDER|GITHUB_TOKEN|podman-container-tools/podman|nightly|main' \
"$file" || true
done
printf '%s\n' '=== Local action metadata references ==='
rg -n -C 8 \
'fetch-latest-podman-version-windows|download-podman-nightly|github_token|github-token|podman-container-tools/podman|actions: read' \
.github . 2>/dev/null | head -n 500 || true
printf '%s\n' '=== Upstream action metadata ==='
curl -L --fail --silent --show-error \
https://raw.githubusercontent.com/redhat-actions/podman-install/6b9121eed76855854291b52c6bfbc278dbdf0288/.github/actions/fetch-latest-podman-version-windows/action.ymlRepository: podman-desktop/e2e
Length of output: 50375
🏁 Script executed:
#!/bin/bash
set -eu
files=(
.github/workflows/podman-desktop-e2e-nightly-windows-wsl.yaml
.github/workflows/desktop-e2e-test-job-windows.yaml
.github/workflows/podman-desktop-e2e-kubernetes.yaml
.github/workflows/podman-desktop-e2e-nightly-windows-hyperv.yaml
.github/workflows/podman-desktop-e2e-remote-windows.yaml
.github/workflows/podman-desktop-e2e-stress-ui-windows.yaml
.github/workflows/prerelease-desktop-e2e-debug-job-windows.yaml
.github/workflows/desktop-e2e-podman-windows-matrix.yaml
)
printf '%s\n' '=== Workflow files and relevant references ==='
for file in "${files[@]}"; do
echo "--- $file"
git ls-files --error-unmatch "$file"
rg -n -C 10 \
'fetch-latest-podman-version-windows|download-podman-nightly|github-token:|github_token:|PODMAN_PROVIDER|GITHUB_TOKEN|podman-container-tools/podman|nightly|main' \
"$file" || true
done
printf '%s\n' '=== Local action definitions and related references ==='
rg -n -C 10 \
'fetch-latest-podman-version-windows|download-podman-nightly|github_token|github-token|podman-container-tools/podman|actions: read' \
.github . 2>/dev/null | head -n 800 || true
printf '%s\n' '=== Upstream fetch action metadata ==='
curl -L --fail --silent --show-error \
https://raw.githubusercontent.com/redhat-actions/podman-install/6b9121eed76855854291b52c6bfbc278dbdf0288/.github/actions/fetch-latest-podman-version-windows/action.ymlRepository: podman-desktop/e2e
Length of output: 50375
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '=== Fetch action metadata at the pinned commit ==='
base='https://raw.githubusercontent.com/redhat-actions/podman-install/6b9121eed76855854291b52c6bfbc278dbdf0288'
curl -L --fail --silent --show-error "$base/.github/actions/fetch-latest-podman-version-windows/action.yml"
printf '%s\n' '=== Files in the pinned upstream action directory ==='
curl -L --fail --silent --show-error \
"https://api.github.com/repos/redhat-actions/podman-install/git/trees/6b9121eed76855854291b52c6bfbc278dbdf0288?recursive=1" |
jq -r '.tree[].path' |
grep -E 'fetch-latest-podman-version-windows|podman.*(js|ts|sh)|action.yml' |
head -n 100
printf '%s\n' '=== Local download action files ==='
fd -i . .github/actions | grep -E 'download-podman-nightly|action\.yml|action\.yaml' || true
printf '%s\n' '=== Local download action metadata and implementation references ==='
while IFS= read -r file; do
echo "--- $file"
sed -n '1,240p' "$file"
done < <(fd -i . .github/actions | grep -E 'download-podman-nightly|action\.yml|action\.yaml' | grep 'download-podman-nightly' || true)
printf '%s\n' '=== Relevant upstream source references ==='
curl -L --fail --silent --show-error \
"https://api.github.com/repos/redhat-actions/podman-install/git/trees/6b9121eed76855854291b52c6bfbc278dbdf0288?recursive=1" |
jq -r '.tree[].path' |
grep -E 'fetch-latest-podman-version-windows' |
while IFS= read -r path; do
echo "--- $path"
curl -L --fail --silent --show-error \
"https://raw.githubusercontent.com/redhat-actions/podman-install/6b9121eed76855854291b52c6bfbc278dbdf0288/$path"
doneRepository: podman-desktop/e2e
Length of output: 11066
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '=== Fetch action metadata at the pinned commit ==='
base='https://raw.githubusercontent.com/redhat-actions/podman-install/6b9121eed76855854291b52c6bfbc278dbdf0288'
curl -L --fail --silent --show-error \
"$base/.github/actions/fetch-latest-podman-version-windows/action.yml"
printf '%s\n' '=== Upstream action tree ==='
curl -L --fail --silent --show-error \
"https://api.github.com/repos/redhat-actions/podman-install/git/trees/6b9121eed76855854291b52c6bfbc278dbdf0288?recursive=1" |
jq -r '.tree[].path' |
grep -E 'fetch-latest-podman-version-windows|action\.(yml|yaml)$' |
head -n 100
printf '%s\n' '=== Local download action ==='
fd -i . .github/actions | grep 'download-podman-nightly' || true
while IFS= read -r file; do
echo "--- $file"
sed -n '1,260p' "$file"
done < <(fd -i . .github/actions | grep 'download-podman-nightly' || true)
printf '%s\n' '=== Relevant upstream action source ==='
curl -L --fail --silent --show-error \
"https://api.github.com/repos/redhat-actions/podman-install/git/trees/6b9121eed76855854291b52c6bfbc278dbdf0288?recursive=1" |
jq -r '.tree[].path' |
grep 'fetch-latest-podman-version-windows' |
while IFS= read -r path; do
echo "--- $path"
curl -L --fail --silent --show-error \
"https://raw.githubusercontent.com/redhat-actions/podman-install/6b9121eed76855854291b52c6bfbc278dbdf0288/$path"
doneRepository: podman-desktop/e2e
Length of output: 10552
🏁 Script executed:
#!/bin/bash
set -u
printf '%s\n' '=== Local download-podman-nightly action ==='
sed -n '1,280p' .github/actions/download-podman-nightly/action.yml
printf '%s\n' '=== External repository visibility and Actions API responses ==='
for endpoint in \
'https://api.github.com/repos/podman-container-tools/podman' \
'https://api.github.com/repos/podman-container-tools/podman/actions/workflows/release-pipeline-validation.yml/runs?status=success&per_page=1' \
'https://api.github.com/repos/podman-container-tools/podman/actions/runs/1/artifacts'; do
echo "--- $endpoint"
curl -sS -D - -o /tmp/api-response \
-H 'Accept: application/vnd.github+json' \
-H 'X-GitHub-Api-Version: 2022-11-28' \
"$endpoint" | sed -n '1,20p'
head -c 1000 /tmp/api-response
printf '\n'
done
printf '%s\n' '=== Exact token wiring across all listed workflows ==='
python3 - <<'PY'
from pathlib import Path
files = [
'.github/workflows/podman-desktop-e2e-nightly-windows-wsl.yaml',
'.github/workflows/desktop-e2e-test-job-windows.yaml',
'.github/workflows/podman-desktop-e2e-kubernetes.yaml',
'.github/workflows/podman-desktop-e2e-nightly-windows-hyperv.yaml',
'.github/workflows/podman-desktop-e2e-remote-windows.yaml',
'.github/workflows/podman-desktop-e2e-stress-ui-windows.yaml',
'.github/workflows/prerelease-desktop-e2e-debug-job-windows.yaml',
'.github/workflows/desktop-e2e-podman-windows-matrix.yaml',
]
for name in files:
lines = Path(name).read_text().splitlines()
fetch = [(i+1, line.strip()) for i, line in enumerate(lines)
if 'github_token:' in line]
download = [(i+1, line.strip()) for i, line in enumerate(lines)
if 'github-token:' in line]
print(name)
print(' fetch:', fetch)
print(' download:', download)
PYRepository: podman-desktop/e2e
Length of output: 9711
🏁 Script executed:
#!/bin/bash
set -u
printf '%s\n' '=== Local download-podman-nightly action ==='
sed -n '1,280p' .github/actions/download-podman-nightly/action.yml
printf '%s\n' '=== External repository visibility and Actions API responses ==='
for endpoint in \
'https://api.github.com/repos/podman-container-tools/podman' \
'https://api.github.com/repos/podman-container-tools/podman/actions/workflows/release-pipeline-validation.yml/runs?status=success&per_page=1' \
'https://api.github.com/repos/podman-container-tools/podman/actions/runs/1/artifacts'; do
echo "--- $endpoint"
curl -sS -D - -o /tmp/api-response \
-H 'Accept: application/vnd.github+json' \
-H 'X-GitHub-Api-Version: 2022-11-28' \
"$endpoint" | sed -n '1,20p'
head -c 1000 /tmp/api-response
printf '\n'
done
printf '%s\n' '=== Exact token wiring across all listed workflows ==='
python3 - <<'PY'
from pathlib import Path
files = [
'.github/workflows/podman-desktop-e2e-nightly-windows-wsl.yaml',
'.github/workflows/desktop-e2e-test-job-windows.yaml',
'.github/workflows/podman-desktop-e2e-kubernetes.yaml',
'.github/workflows/podman-desktop-e2e-nightly-windows-hyperv.yaml',
'.github/workflows/podman-desktop-e2e-remote-windows.yaml',
'.github/workflows/podman-desktop-e2e-stress-ui-windows.yaml',
'.github/workflows/prerelease-desktop-e2e-debug-job-windows.yaml',
'.github/workflows/desktop-e2e-podman-windows-matrix.yaml',
]
for name in files:
lines = Path(name).read_text().splitlines()
fetch = [(i + 1, line.strip()) for i, line in enumerate(lines)
if 'github_token:' in line]
download = [(i + 1, line.strip()) for i, line in enumerate(lines)
if 'github-token:' in line]
print(name)
print(' fetch:', fetch)
print(' download:', download)
PYRepository: podman-desktop/e2e
Length of output: 9711
🌐 Web query:
GitHub Actions GITHUB_TOKEN access repository other than repository where workflow runs Actions artifacts REST API public repository permissions
💡 Result:
The GITHUB_TOKEN provided by GitHub Actions is automatically scoped to the repository where the workflow is running [1][2]. It cannot be used to access resources—such as artifacts or code—in other repositories by default [1][2][3]. To access resources in another repository, you must use a token with appropriate permissions, such as a personal access token (PAT) or a GitHub App installation access token [4][5][2][3]. Regarding artifacts specifically: - When using the official actions/download-artifact action to download an artifact from a different repository or a different workflow run, you must explicitly provide a github-token input with the necessary permissions (specifically actions:read on the target repository) [6][3]. - The default GITHUB_TOKEN will fail to access these external resources because its scope is strictly limited to the current repository [1][2][3]. For general REST API requests to other repositories, the same rule applies: you cannot use the GITHUB_TOKEN for cross-repository operations [1][2]. You must use a PAT or GitHub App token that has been configured with the required permissions for the target repository [4][5]. If you are working with public repositories, note that while anyone with read access can typically list artifacts via the REST API [7], the GITHUB_TOKEN itself remains scoped to its home repository, and you still need to authenticate as an entity that has access to the target repository if your workflow needs to perform actions beyond what is publicly permitted [4][5].
Citations:
- 1: https://docs.github.com/en/actions/concepts/security/github_token
- 2: https://some-natalie.dev/blog/multi-repo-actions/
- 3: https://deepwiki.com/actions/download-artifact/3.3-cross-repository-downloads
- 4: https://docs.github.com/en/actions/tutorials/authenticate-with-github_token
- 5: https://docs.github.com/actions/reference/authentication-in-a-workflow
- 6: https://github.com/actions/download-artifact/blob/main/README.md
- 7: https://docs.github.com/en/rest/actions/artifacts
🌐 Web query:
site:docs.github.com GITHUB_TOKEN permissions repository where workflow runs access other repositories
💡 Result:
The GITHUB_TOKEN provided to GitHub Actions workflows is scoped strictly to the repository where the workflow is running [1]. It cannot be used to access other repositories [2][3]. If your workflow requires access to resources in other repositories or organization-level resources, you must use a different authentication method [2]. Recommended alternatives include: 1. GitHub Apps: Create a GitHub App, install it on the relevant repositories, and use it to generate an installation access token within your workflow [4][2]. This is the preferred approach for cross-repository access [2]. 2. Personal Access Tokens (PATs): Create a classic or fine-grained personal access token with the necessary permissions, store it as a secret in your repository, and reference it in your workflow [4][3]. While the GITHUB_TOKEN cannot access other repositories, you can configure its permissions within its home repository using the permissions key in your workflow file [4][5]. It is a security best practice to follow the principle of least privilege by granting the token only the minimum permissions required for the specific job [4][6].
Citations:
- 1: https://docs.github.com/en/actions/concepts/security/github_token
- 2: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/making-authenticated-api-requests-with-a-github-app-in-a-github-actions-workflow
- 3: https://docs.github.com/en/packages/learn-github-packages/about-permissions-for-github-packages
- 4: https://docs.github.com/en/actions/tutorials/authenticate-with-github_token
- 5: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository
- 6: https://docs.github.com/en/actions/reference/security/secure-use
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '=== Workflow version inputs and schedules ==='
python3 - <<'PY'
from pathlib import Path
import re
files = [
'.github/workflows/podman-desktop-e2e-nightly-windows-wsl.yaml',
'.github/workflows/desktop-e2e-test-job-windows.yaml',
'.github/workflows/podman-desktop-e2e-kubernetes.yaml',
'.github/workflows/podman-desktop-e2e-nightly-windows-hyperv.yaml',
'.github/workflows/podman-desktop-e2e-remote-windows.yaml',
'.github/workflows/podman-desktop-e2e-stress-ui-windows.yaml',
'.github/workflows/prerelease-desktop-e2e-debug-job-windows.yaml',
'.github/workflows/desktop-e2e-podman-windows-matrix.yaml',
]
for name in files:
text = Path(name).read_text()
defaults = re.findall(r'^\s+podman_version:\s*$', text, re.M)
print(f'{name}:')
for i, line in enumerate(text.splitlines(), 1):
if 'cron:' in line or 'default:' in line and 'nightly' in line or 'description:' in line and 'nightly' in line:
print(f' {i}: {line.strip()}')
PY
printf '%s\n' '=== Relevant GitHub API documentation headers ==='
for url in \
'https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication' \
'https://docs.github.com/en/rest/actions/artifacts'; do
echo "--- $url"
curl -L --fail --silent --show-error "$url" |
sed 's/<[^>]*>/ /g' |
tr -s ' ' |
grep -oiE '.{0,120}(repository|GITHUB_TOKEN|artifact|Actions: read|permissions).{0,220}' |
head -n 20 || true
doneRepository: podman-desktop/e2e
Length of output: 10569
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '=== Workflow version inputs and schedules ==='
python3 - <<'PY'
from pathlib import Path
files = [
'.github/workflows/podman-desktop-e2e-nightly-windows-wsl.yaml',
'.github/workflows/desktop-e2e-test-job-windows.yaml',
'.github/workflows/podman-desktop-e2e-kubernetes.yaml',
'.github/workflows/podman-desktop-e2e-nightly-windows-hyperv.yaml',
'.github/workflows/podman-desktop-e2e-remote-windows.yaml',
'.github/workflows/podman-desktop-e2e-stress-ui-windows.yaml',
'.github/workflows/prerelease-desktop-e2e-debug-job-windows.yaml',
'.github/workflows/desktop-e2e-podman-windows-matrix.yaml',
]
for name in files:
print(f'{name}:')
for i, line in enumerate(Path(name).read_text().splitlines(), 1):
if (
'cron:' in line
or ('default:' in line and 'nightly' in line)
or ('description:' in line and 'nightly' in line)
):
print(f' {i}: {line.strip()}')
PY
printf '%s\n' '=== GitHub API documentation excerpts ==='
for url in \
'https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication' \
'https://docs.github.com/en/rest/actions/artifacts'; do
echo "--- $url"
curl -L --fail --silent --show-error "$url" |
sed 's/<[^>]*>/ /g' |
tr -s ' ' |
grep -oiE '.{0,120}(repository|GITHUB_TOKEN|artifact|Actions: read|permissions).{0,220}' |
head -n 20 || true
doneRepository: podman-desktop/e2e
Length of output: 10561
Pass a cross-repository Actions token for nightly Podman artifacts.
When podman_version is nightly or main, the fetch action queries podman-container-tools/podman and requires authenticated API access. All eight workflows pass the repository-scoped GITHUB_TOKEN to both actions, so nightly artifact resolution or download can fail. Use a GitHub App or fine-grained token with Actions: read access to podman-container-tools/podman, and pass it to both github_token and github-token.
📍 Affects 8 files
.github/workflows/podman-desktop-e2e-nightly-windows-wsl.yaml#L138-L139(this comment).github/workflows/desktop-e2e-test-job-windows.yaml#L138-L139.github/workflows/podman-desktop-e2e-kubernetes.yaml#L130-L131.github/workflows/podman-desktop-e2e-nightly-windows-hyperv.yaml#L144-L145.github/workflows/podman-desktop-e2e-remote-windows.yaml#L162-L163.github/workflows/podman-desktop-e2e-stress-ui-windows.yaml#L156-L157.github/workflows/prerelease-desktop-e2e-debug-job-windows.yaml#L178-L179.github/workflows/desktop-e2e-podman-windows-matrix.yaml#L145-L146
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/podman-desktop-e2e-nightly-windows-wsl.yaml around lines
138 - 139, Replace the repository-scoped GITHUB_TOKEN used by both github_token
and github-token in all eight
workflows—.github/workflows/podman-desktop-e2e-nightly-windows-wsl.yaml
(138-139), .github/workflows/desktop-e2e-test-job-windows.yaml (138-139),
.github/workflows/podman-desktop-e2e-kubernetes.yaml (130-131),
.github/workflows/podman-desktop-e2e-nightly-windows-hyperv.yaml (144-145),
.github/workflows/podman-desktop-e2e-remote-windows.yaml (162-163),
.github/workflows/podman-desktop-e2e-stress-ui-windows.yaml (156-157),
.github/workflows/prerelease-desktop-e2e-debug-job-windows.yaml (178-179), and
.github/workflows/desktop-e2e-podman-windows-matrix.yaml (145-146)—with a
configured GitHub App or fine-grained token having Actions: read access to
podman-container-tools/podman.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates Windows E2E workflows to use
fetch-latest-podman-version-windowsfrom redhat-actions/podman-install#26 (pinned to6b9121e). That sub-action resolves Podman installer URLs for releases and fornightly/mainCI artifacts, exposing an Actionsarchive_download_urlviadownload_url.download-podman-nightlynow forwards that URL plus a GitHub token (-githubToken) intopodman.ps1, so the Windows host downloads nightly artifacts the same way as public MSI release URLs. Affected workflows passgithub_tokeninto the fetch step andgithub-tokenintodownload-podman-nightly. The nightly WSL workflow defaults topodman_version: nightly.Depends on a
pde2e-podmanimage that supports authenticated Actions artifact downloads (see the matching pde2e-podman PR on586-switch-pulling-podman-nightly, odockal/pde2e-podman#13).Closes partially podman-desktop/e2e#586
Test plan
podman_version: latest(public release MSI URL, no token required for download)podman_version: nightly(Actions artifact URL + token → download/install on Windows)podman-desktop-e2e-nightly-windows-wslscheduled/dispatch defaults to nightlypde2e-podmanimage tag that includes-githubTokensupport