Github_workflows

[Sh4d0wHunt3rX]

I'm not sure if the thing I'm saying is good or no, but I was thinking maybe hide these warning or not issue them as warning.

[TheTechromancer]

@domwhewell-sage might have thoughts

[domwhewell-sage]

Was this run run without an API key? I remember the permissions for the github workflows was quite confusing... #1305 (comment)

That reminds me perhaps we need to require an API key for github_workflows and not the other two.

[Sh4d0wHunt3rX]

Hey @domwhewell-sage , thanks a lot for checking this. Yes, I have setup a different API key for each different BBOT Github modules which are in secrets.yml.

[domwhewell-sage]

Thanks @Sh4d0wHunt3rX could you confirm what permissions they have?

[Sh4d0wHunt3rX]

Sure, here you are:

So, I guess maybe I needed to enable "workflows" for my github workflows api?

[domwhewell-sage]

Let me replicate the same permissions and get back to you, I believe the documentation only states you need the whole repo scope.

[Sh4d0wHunt3rX]

Thanks : ) Very noob question. The workflows and repos that I'm trying to access do not belong to me. Maybe this is a normal behavior that I do not have the permission to access them?

[domwhewell-sage]

The repo in your screenshot is publicly available. And the artifact is publicly accessible (Via the web), It's just specific permissions are still required to download it via the API :/

[domwhewell-sage]

Hmm, I mirrored your API key permissions and I can download those Facebook artifacts

[Sh4d0wHunt3rX]

Strange 🤔 Maybe it's kind of rate limiting. But I get this error on many scans, I thought that it's a normal error that the workflow is not public. I will tell you the next time I get it. 🙏