advisory-scan: read-only GitHub token from env or file (rate limit only)

Anonymous GitHub API is 60 req/hr — a full weekly sweep across ~20 recipes exhausts
it and the scan then reports sources as failed (visible, but degraded coverage). A
token lifts it to 5000/hr.

_github_token(): GITHUB_TOKEN env wins, else GITHUB_TOKEN_FILE (default
/srv/cc-ci/.github-token, 0600, gitignored). Reading PUBLIC advisories needs NO
scopes — a classic PAT with nothing ticked, or fine-grained limited to 'Public
repositories: read'. The tool only ever GETs advisories; do not grant write scopes.
A missing token is not an error: the scan runs anonymously and surfaces failures.

Also gitignores .github-token and .hcloud-token.

This commit is contained in:

autonomic-bot

2026-08-10 18:38:45 +00:00

parent 5775fe23f8

commit cf26ef863a

2 changed files with 26 additions and 1 deletions

.gitignore

View File

@@ -28,3 +28,7 @@ master-age.txt
 # Python bytecode cache
 __pycache__/
 *.pyc
 # Local API tokens — never committed (advisory-scan / hetzner recovery)
 .github-token
 .hcloud-token