I had a contract do some work for me, they pushed some code to my GitHub which uses GitHub Actions to deploy to my fly server. What is odd, is that even if that individual does not do a push to my repo, it automatically pulls his information and says on Fly’s dashboard that he did a release?
I’m wondering why that might be?
I’ts likely their GitHub token is being used to deploy this app and if the deployment is still working that means they have access to that repo.
fly tokens to generate an app-deployment/organization token and put in your repo secrets.Thanks @lubien - they’ve been removed from the GitHub project for some time. Would that mean that their GitHub token is being used for the Fly instance?
It probably means their Fly.io token is being used. Can you check on your organization “Team” tab that they’re not in the org anymore?
Just me listed as a member, no one else.
I see now! You might want to check your offboarding checklist to see whats left to completely remove them from your org. Go to your dashboard and click on “Offboarding” on the left. The URL is roughly:
https://fly.io/dashboard/:org_slug/offboarding
Am I able to just use an organization token rather than independent tokens for GitHub action based deployments?
Yes! We recommend app deploy tokens because they’re very scoped so if GitHub ever leaks those (who knows) its less scary but an org token or even your user token should both do
It was determined that the individual still had a token active, this token was what was used on the GitHub Action Secret which lead to the UI behavior. After removing their token, replacing with an organization token it now reflects accordingly.
Thank you for your help!
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.