Use read-only token for Danger

[pgwillia]

Context

Starting March 1st, 2021 workflow runs that are triggered by Dependabot from push, pull_request, pull_request_review, or pull_request_review_comment events will be treated as if they were opened from a repository fork. This means they will receive a read-only GITHUB_TOKEN and will not have access to any secrets available in the repository.

Note that this DOES NOT allow developers the possibility to propose change sets from a fork of the repository. This hasn't been possible since the policy change in Travis.

Related to #2082

What's New

Changed Danger github action to use the read-only GITHUB_TOKEN

[murny]

CI builds look great 👍

A bit confused on the magic that makes this work? DANGER_GITHUB_API_TOKEN is a token that supplies access to our github Bot Account. So how does replacing it with GITHUB_TOKEN (which doesn't seem to be defined in our secrets) do the same thing but better?

Be interesting to see if Danger is still working by seeing it use our bot account to comment on PRs, then I'll accept this magic 😄.

I guess a easy way to test this if danger can still comment is to create a PR with an empty description or change your changelog entry to be less then 10 characters 🤔 .

Otherwise looks good to me, nice work investigating this 👍

Edit: If danger cannot make comments then seems maybe the missing link is we just need create a new secret token called GITHUB_TOKEN and add the same value we used for DANGER_GITHUB_API_TOKEN (and then remove DANGER_GITHUB_API_TOKEN). Basically just renaming DANGER_GITHUB_API_TOKEN to GITHUB_TOKEN.

This works because from the docs GITHUB_TOKEN is exposed, while other tokens do not get exposed?

Note: With the exception of GITHUB_TOKEN, secrets are not passed to the runner when a workflow is triggered from a forked repository.

From https://docs.github.com/en/actions/reference/encrypted-secrets#using-encrypted-secrets-in-a-workflow

[pgwillia]

I'm a bit confused about the magic that makes this work too. Not going to merge until I can figure out if it's actually working.