Passing the GITHUB_TOKEN secret to a JavaScript file (All About OAuth2)

GitHub Actions come with their own special token that must be passed to each workflow step explicitly: ‘secrets.GITHUB_TOKEN’. Unlike Personal Access Tokens that I explained in the previous post of this series, you don’t have to manually create them. A unique ‘GITHUB_TOKEN’ is created each time your GitHub Action is run.

Let’s start out by creating a new workflow file at .github/workflows/pr-comment.yml

name: PR Comment
on:
  # Run this workflow only when a new pull request is opened
  # compare: https://git.io/JvTyV
  pull_request:
    types: [opened]

jobs:
  pr_comment:
    runs-on: ubuntu-latest

    steps:
      # Make files accessible to actions
      # https://github.com/actions/checkout#readme
      - uses: actions/checkout@v2
      # Install Node
      # https://github.com/actions/setup-node#readme
      - uses: actions/setup-node@v1
        with:
          node-version: 12
      # Install dependencies
      - run: npm ci
      # Run pr-comment.js with Node and pass the authentication token 
      - run: node .github/actions/pr-comment.js
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

1.1.3.1 Passing the GITHUB_TOKEN secret to a JavaScript file