Is it safe to publicize BUNDLESIZE_GITHUB_TOKEN ? about bundlesize

[siddharthkp]

@maestromac You are right. CI tools don't expose the token in forks to protect your tokens. The solution to this is not to make your token public either :)

I have an alternate solution in mind and will test it in the beta branch soon 👍

[maestromac]

@siddharthkp yes Travis provides TRAVIS_REPO_SLUG which should return the source repo (source).

I think the new version sound like the exact solution we need. I'm going to give bundlesize2 a try soon and let you know.

[maestromac]

@siddharthkp initial use seems to be working without issue 👍 . Will let you know if we hit anything

[siddharthkp]

That's great! Closing the issue here. But will explore fork use case in the other repo

[Haroenv]

No, the GitHub token is private

[fgerschau]

Just encrypt it with

travis encrypt BUNDLESIZE_GITHUB_TOKEN="your-key" --add env.global

or add it as an environment variable in the settings of your travis repo

[maestromac]

@fgerschau Thanks for the suggestion but that wouldn't work because PR from forked repository won't have access to it ref

Encrypted environment variables are not available to pull requests from forks due to the security risk of exposing such information to unknown code.

[rhymes]

@siddharthkp any updates on the alternate solution? Thank you!

[siddharthkp]

Hey! I'm working on a new version (1.0.0) of bundlesize that fixes all of these problems. For source repo - it uses github apps + checks

Don't have a solution for forks yet - but something I want to play around with more.

It doesn't require a token but still needs a way to identify the repo

1. If there is a way to get source repo from the fork in CI environments then it would be very easy.
2. Otherwise, might want to add an additional row in bundlesize config which identifies the repo
3. I'm not sure if it can be read from .git/config or package.json to avoid step 2

Ideas welcome

---

If you'd like you can try it out: https://github.com/siddharthkp/bundlesize2

Migration path:

1. Use the npm package bundlesize2 instead of bundlesize
2. If you'd like status reported back to github, use the flag --enable-github-checks + authorize bundlesize2 app. More in the docs
3. If anything breaks, let me know :)

Note: This is only until the new version is ready and then it will be merged back in this project as a major release