Post

Shipped the first version of Danger JS to use trusted publishing. For the longest time Danger operated on the Moya community guidelines (if you get a PR merged, we'll offer you org access) which meant if GitHub write access was what mattered, then we had over 200 people who could make deploys!

24/8/26, 7:27 am0 reposts4 likes

Orta Therox

@orta.io

24 Aug

Not great! So, I previously gated deploys by my computer etc Now, I have it so that only org admins can create tags and a CODEOWNERS for workflows. Deploys then run off the tags.