Add TOKEN variable to random_file.py #20

	###############################################
	# This contains insecure examples
	# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
	###############################################
	on:
	pull_request_target:
	pull_request:
	jobs:
	build:
	name: Build and test
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v2
	with:
	ref: ${{ github.event.pull_request.head.sha }}

	- uses: actions/setup-node@v1
	- run: \|
	npm install
	npm build

	- uses: completely/fakeaction@v2
	with:
	arg1: ${{ secrets.FLAG }}

	- uses: fakerepo/comment-on-pr@v1
	with:
	message: \|
	Thank you!

	build2:
	name: Build and test 2
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v2.3.4
	with:
	ref: ${{ github.event.pull_request.head.sha }}

	- uses: actions/setup-node@v1
	- run: \|
	npm install
	npm build

	- uses: completely/fakeaction@v2
	with:
	arg1: ${{ secrets.FLAG }}

	- uses: fakerepo/comment-on-pr@v1
	with:
	message: \|
	Thank you!

	this-is-safe-because-no-checkout:
	name: Echo
	runs-on: ubuntu-latest
	steps:
	- name: echo
	run: \|
	echo "Hello, world"

	# cf. https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md
	spelling:
	name: Spell checking
	runs-on: ubuntu-latest
	steps:
	- name: checkout-merge
	if: contains(github.event_name, 'pull_request')
	uses: actions/checkout@v2
	with:
	ref: refs/pull/${{github.event.pull_request.number}}/merge

Provide feedback