Permissions that change with version?

[irongut]

I'm wondering if you have any provision for an action's token permissions changing with a new version?

One of my actions in the KB currently doesn't use a token but a future version will require a token with permission to add comments to pull requests. I'm planning those changes at the moment so I thought I would ask how that would be handled.

[varunsh-coder]

Hi @irongut, sorry I missed this discussion. GitHub does not send notifications for discussions. Please tag me in discussions in the future.

For your question, unfortunately, we don't have a good way to know if an Action changes its permissions. Do let me know if you have ideas.

We used to create an issue in Action repo about their action-security.yaml file, but I don't think we were able to get the message across.

For your scenario, feel free to update the action-security.yaml file for your Action, or just create an issue, and I can update it.