GitHub token

[victorlin]

There is an expired fine-grained token on @nextstrain-bot named "[steampipe] GitHub Steampipe plugin". It was created on Wed, Sep 6 2023. I'm not sure when it expired, but it looks to have been unused for some time.

This repo uses a GITHUB_TOKEN for Steampipe:

status/.github/workflows/ci.yaml

Lines 38 to 40 in 3c51133

	- run: make --assume-old=favicon.svg --assume-old="favicon-[layer].svg.py"
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

There is no secret named GITHUB_TOKEN in either repo or org secrets. This means it's not the expired fine-grained token, but rather the default GitHub token for the repo. I confirmed this by switching it to read-only and saw the permissions change (before and after). I've switched it back to the previous setting, read+write.

Proposals

I think we should do 2 things:

1. Delete the expired fine-grained token.
2. Set the token permissions to read-only since that worked fine. I believe it's currently set to read+write only because it's the organization default. We could also consider setting the organization default to read-only to apply this to new repos.