More secure private attachments - GA

[tuves]

Previously, all attached (drag-and-dropped) images and videos on GitHub Issues, Pull Requests, Discussions, and wikis were available to view without authentication if you knew their direct URL.
Now, future attachments associated with private repositories can only be viewed after logging in.
This doesn't apply retroactively to existing attachments, which are obfuscated by having a long, unguessable URL.

Email notifications sent from private repositories will no longer display images; each image is replaced by a link to view it on the web.
Content inside a Git repository is not affected by this change and has always required authentication for private repositories.

Learn more about attaching files.

[aokabi]

Do you have plans to introduce the feature to internal repository in the future?

[vtbassmatt]

Good catch, this also applies to internal repositories :)

[kamilhism]

Hi!

Sorry, is there any plans to return signed links via API? There're a lot of scripts/actions that expect accessible URLs of images and other attachments, and currently all of them are broken since not signed links are being returned via API and event payloads in Actions 😢 As I see right now the only way to get signed link via API is to use graphql API and bodyHTML field, but it's not very convenient... Maybe it makes sense to give ability to pass some header/param (e.g. sign_attachments=true) in request if you don't want to return signed links by default?

Thanks.

[edwarddamato]

Hey @kjgstarr, apologies for the late reply! The main customers for this is ourselves (our own organisation). We have product translation workflows set up in various Github repositories that heavily relied on screenshots uploaded in pull requests to provide context to translators. This is now not possible anymore as we're unable to programmatically retrieve these screenshots anymore through our custom Github actions.

[james-skinner-deltatre]

essentially the same issue in our org - deltatre-vxp