[ANNOUNCEMENT] New Personal Access Token types

[spenserblack]

GitHub has moved a new, more fine-grained PAT type to public beta. It might be worth documenting both the old and new way of generating tokens.

Related docs: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#creating-a-fine-grained-personal-access-token

[lowlighter]

This new tokens looks really cool and are definitely a step up security wise

However it's gonna bring so much work for metrics lol 🥲

Besides the documentation updates, some permissions may have been reworked or moved around, so I'm not sure how it'll end up, especially for plugins that uses a lot of different scopes such as the achievements one or even the base one

Hopefully it won't be too much trouble to handle, but I don't want to pollute too much the code with legacy token handling in all plugins so it may result in a new major release to only support these new tokens (provided the "beta" is close enough to being "stable")

[lowlighter]

Just so you know, I tried to test these but currently it's not possible to use them to access GitHub GraphQL API...
https://docs.github.com/fr/graphql/guides/forming-calls-with-graphql#authenticating-with-graphql

So for now only classic and legacy tokens can be used with this action 😅

[spenserblack]

Update: github/roadmap#622

[spenserblack]

Going through my old discussions and cleaning them up. Even though that roadmap issue is still open currently, it seems like fine-grained tokens now work fully (within the scopes that you set) with GraphQL.