diff --git a/README.md b/README.md index dcc14cb..3bcce1e 100644 --- a/README.md +++ b/README.md @@ -53,6 +53,7 @@ To setup Development freeze, we need three files: * Workflow that runs on `workflow-run` trigger, downloads artifact and runs `devel_freezer` GitHub Action * `development-freeze` configuration + > **Note**: Setup is complicated due to GitHub [permissions on `GITHUB_TOKEN`](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token). When used in workflow executed from fork it has `read-only` permissions. By using `workflow-run` trigger we are able to [safely overcome this limitation](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/) and it allow us to comment on Pull Requests. ```yml