Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Parker Brown
|
e715b04a11 |
@@ -0,0 +1,17 @@
|
||||
name: 'Publish Immutable Action'
|
||||
|
||||
on:
|
||||
release:
|
||||
types: [published]
|
||||
|
||||
jobs:
|
||||
publish:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write
|
||||
packages: write
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- name: Publish Immutable Action
|
||||
uses: actions/publish-immutable-action@v0.0.4
|
||||
@@ -0,0 +1,41 @@
|
||||
name: release
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- "*.x"
|
||||
- main
|
||||
- beta
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
issues: write
|
||||
pull-requests: write
|
||||
|
||||
jobs:
|
||||
release:
|
||||
name: release
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# build local version to create token
|
||||
- uses: actions/checkout@v6
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
|
||||
|
||||
- run: npm ci
|
||||
- run: npm run build
|
||||
- uses: ./
|
||||
id: app-token
|
||||
with:
|
||||
app-id: ${{ vars.RELEASER_APP_ID }}
|
||||
private-key: ${{ secrets.RELEASER_APP_PRIVATE_KEY }}
|
||||
# install release dependencies and release
|
||||
- run: npm install --no-save @semantic-release/git semantic-release-plugin-github-breaking-version-tag
|
||||
- run: npx semantic-release --debug
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
|
||||
@@ -0,0 +1,34 @@
|
||||
# This workflow warns and then closes issues that have had no activity for a specified amount of time.
|
||||
# https://github.com/actions/stale
|
||||
|
||||
name: Stale
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
schedule:
|
||||
# 00:00 UTC on Mondays
|
||||
- cron: '0 0 * * 1'
|
||||
|
||||
permissions:
|
||||
issues: write
|
||||
pull-requests: write
|
||||
|
||||
env:
|
||||
DAYS_BEFORE_STALE: 180
|
||||
DAYS_BEFORE_CLOSE: 60
|
||||
STALE_LABEL: 'stale'
|
||||
STALE_LABEL_URL: ${{github.server_url}}/${{github.repository}}/labels/stale
|
||||
|
||||
jobs:
|
||||
stale:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/stale@v10
|
||||
with:
|
||||
operations-per-run: 100
|
||||
days-before-stale: ${{ env.DAYS_BEFORE_STALE }}
|
||||
days-before-close: ${{ env.DAYS_BEFORE_CLOSE }}
|
||||
stale-issue-label: ${{ env.STALE_LABEL }}
|
||||
stale-pr-label: ${{ env.STALE_LABEL }}
|
||||
stale-issue-message: 'This issue has been marked ${{ env.STALE_LABEL_URL }} because it has been open for ${{ env.DAYS_BEFORE_STALE }} days with no activity. Please close this issue if it is no longer needed. If this issue is still relevant and you would like it to remain open, simply update it within the next ${{ env.DAYS_BEFORE_CLOSE }} days.'
|
||||
stale-pr-message: 'This pull request has been marked ${{ env.STALE_LABEL_URL }} because it has been open for ${{ env.DAYS_BEFORE_STALE }} days with no activity. Please close this pull request if it is no longer needed. If this pull request is still relevant and you would like it to remain open, simply update it within the next ${{ env.DAYS_BEFORE_CLOSE }} days.'
|
||||
@@ -0,0 +1,55 @@
|
||||
name: test
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
pull_request:
|
||||
merge_group:
|
||||
workflow_dispatch:
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
integration:
|
||||
name: integration
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
|
||||
- uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
|
||||
- run: npm ci
|
||||
- run: npm test
|
||||
|
||||
end-to-end:
|
||||
name: end-to-end
|
||||
runs-on: ubuntu-latest
|
||||
# do not run from forks, as forks don’t have access to repository secrets
|
||||
if: github.event_name == 'merge_group' || github.event.pull_request.head.repo.owner.login == github.event.pull_request.base.repo.owner.login
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
- run: npm ci
|
||||
- run: npm run build
|
||||
- uses: ./ # Uses the action in the root directory
|
||||
id: test
|
||||
with:
|
||||
app-id: ${{ vars.TEST_APP_ID }}
|
||||
private-key: ${{ secrets.TEST_APP_PRIVATE_KEY }}
|
||||
- uses: octokit/request-action@v2.x
|
||||
id: get-repository
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ steps.test.outputs.token }}
|
||||
with:
|
||||
route: GET /installation/repositories
|
||||
- run: echo '${{ steps.get-repository.outputs.data }}'
|
||||
@@ -0,0 +1,42 @@
|
||||
name: Update Permission Inputs
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
paths:
|
||||
- 'package.json'
|
||||
- 'package-lock.json'
|
||||
workflow_dispatch:
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
|
||||
jobs:
|
||||
update-permission-inputs:
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
COMMIT_MESSAGE: 'feat: update permission inputs'
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
- name: Run permission inputs update script
|
||||
run: node scripts/update-permission-inputs.js
|
||||
- name: Commit changes
|
||||
id: auto-commit
|
||||
uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6.0.1
|
||||
with:
|
||||
commit_message: ${{ env.COMMIT_MESSAGE }}
|
||||
- name: Update PR title
|
||||
if: github.event_name == 'pull_request' && steps.auto-commit.outputs.changes_detected == 'true'
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
gh pr edit ${{ github.event.pull_request.number }} --title "${{ env.COMMIT_MESSAGE }}"
|
||||
@@ -1,4 +1,3 @@
|
||||
.env
|
||||
coverage
|
||||
node_modules/
|
||||
.DS_Store
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
{
|
||||
".": "3.1.1"
|
||||
}
|
||||
@@ -9,10 +9,10 @@ GitHub Action for creating a GitHub App installation access token.
|
||||
In order to use this action, you need to:
|
||||
|
||||
1. [Register new GitHub App](https://docs.github.com/apps/creating-github-apps/setting-up-a-github-app/creating-a-github-app).
|
||||
2. [Store the App's Client ID in your repository variables](https://docs.github.com/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables#defining-configuration-variables-for-multiple-workflows) (example: `APP_CLIENT_ID`).
|
||||
3. [Store the App's private key in your repository secrets](https://docs.github.com/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets?tool=webui#creating-secrets-for-a-repository) (example: `APP_PRIVATE_KEY`).
|
||||
2. [Store the App's ID or Client ID in your repository environment variables](https://docs.github.com/actions/learn-github-actions/variables#defining-configuration-variables-for-multiple-workflows) (example: `APP_ID`).
|
||||
3. [Store the App's private key in your repository secrets](https://docs.github.com/actions/security-guides/encrypted-secrets?tool=webui#creating-encrypted-secrets-for-a-repository) (example: `PRIVATE_KEY`).
|
||||
|
||||
> [!IMPORTANT]
|
||||
> [!IMPORTANT]
|
||||
> An installation access token expires after 1 hour. Please [see this comment](https://github.com/actions/create-github-app-token/issues/121#issuecomment-2043214796) for alternative approaches if you have long-running processes.
|
||||
|
||||
### Create a token for the current repository
|
||||
@@ -28,11 +28,11 @@ jobs:
|
||||
hello-world:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/create-github-app-token@v3
|
||||
- uses: actions/create-github-app-token@v2
|
||||
id: app-token
|
||||
with:
|
||||
client-id: ${{ vars.APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
||||
app-id: ${{ vars.APP_ID }}
|
||||
private-key: ${{ secrets.PRIVATE_KEY }}
|
||||
- uses: ./actions/staging-tests
|
||||
with:
|
||||
token: ${{ steps.app-token.outputs.token }}
|
||||
@@ -47,19 +47,19 @@ jobs:
|
||||
auto-format:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/create-github-app-token@v3
|
||||
- uses: actions/create-github-app-token@v2
|
||||
id: app-token
|
||||
with:
|
||||
# required
|
||||
client-id: ${{ vars.APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
||||
- uses: actions/checkout@v6
|
||||
app-id: ${{ vars.APP_ID }}
|
||||
private-key: ${{ secrets.PRIVATE_KEY }}
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
token: ${{ steps.app-token.outputs.token }}
|
||||
ref: ${{ github.head_ref }}
|
||||
# Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
|
||||
persist-credentials: false
|
||||
- uses: creyD/prettier_action@v6
|
||||
- uses: creyD/prettier_action@v4.3
|
||||
with:
|
||||
github_token: ${{ steps.app-token.outputs.token }}
|
||||
```
|
||||
@@ -73,12 +73,12 @@ jobs:
|
||||
auto-format:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/create-github-app-token@v3
|
||||
- uses: actions/create-github-app-token@v2
|
||||
id: app-token
|
||||
with:
|
||||
# required
|
||||
client-id: ${{ vars.APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
||||
app-id: ${{ vars.APP_ID }}
|
||||
private-key: ${{ secrets.PRIVATE_KEY }}
|
||||
- name: Get GitHub App User ID
|
||||
id: get-user-id
|
||||
run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
|
||||
@@ -98,12 +98,12 @@ jobs:
|
||||
auto-format:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/create-github-app-token@v3
|
||||
- uses: actions/create-github-app-token@v2
|
||||
id: app-token
|
||||
with:
|
||||
# required
|
||||
client-id: ${{ vars.APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
||||
app-id: ${{ vars.APP_ID }}
|
||||
private-key: ${{ secrets.PRIVATE_KEY }}
|
||||
- name: Get GitHub App User ID
|
||||
id: get-user-id
|
||||
run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
|
||||
@@ -135,13 +135,13 @@ jobs:
|
||||
hello-world:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/create-github-app-token@v3
|
||||
- uses: actions/create-github-app-token@v2
|
||||
id: app-token
|
||||
with:
|
||||
client-id: ${{ vars.APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
||||
app-id: ${{ vars.APP_ID }}
|
||||
private-key: ${{ secrets.PRIVATE_KEY }}
|
||||
owner: ${{ github.repository_owner }}
|
||||
- uses: peter-evans/create-or-update-comment@v4
|
||||
- uses: peter-evans/create-or-update-comment@v3
|
||||
with:
|
||||
token: ${{ steps.app-token.outputs.token }}
|
||||
issue-number: ${{ github.event.issue.number }}
|
||||
@@ -157,16 +157,16 @@ jobs:
|
||||
hello-world:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/create-github-app-token@v3
|
||||
- uses: actions/create-github-app-token@v2
|
||||
id: app-token
|
||||
with:
|
||||
client-id: ${{ vars.APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
||||
app-id: ${{ vars.APP_ID }}
|
||||
private-key: ${{ secrets.PRIVATE_KEY }}
|
||||
owner: ${{ github.repository_owner }}
|
||||
repositories: |
|
||||
repo1
|
||||
repo2
|
||||
- uses: peter-evans/create-or-update-comment@v4
|
||||
- uses: peter-evans/create-or-update-comment@v3
|
||||
with:
|
||||
token: ${{ steps.app-token.outputs.token }}
|
||||
issue-number: ${{ github.event.issue.number }}
|
||||
@@ -182,45 +182,23 @@ jobs:
|
||||
hello-world:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/create-github-app-token@v3
|
||||
- uses: actions/create-github-app-token@v2
|
||||
id: app-token
|
||||
with:
|
||||
client-id: ${{ vars.APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
||||
app-id: ${{ vars.APP_ID }}
|
||||
private-key: ${{ secrets.PRIVATE_KEY }}
|
||||
owner: another-owner
|
||||
- uses: peter-evans/create-or-update-comment@v4
|
||||
- uses: peter-evans/create-or-update-comment@v3
|
||||
with:
|
||||
token: ${{ steps.app-token.outputs.token }}
|
||||
issue-number: ${{ github.event.issue.number }}
|
||||
body: "Hello, World!"
|
||||
```
|
||||
|
||||
### Create a token for an enterprise installation
|
||||
|
||||
```yaml
|
||||
on: [workflow_dispatch]
|
||||
|
||||
jobs:
|
||||
hello-world:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/create-github-app-token@v3
|
||||
id: app-token
|
||||
with:
|
||||
client-id: ${{ vars.APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
||||
enterprise: my-enterprise-slug
|
||||
- name: Call enterprise management REST API with gh
|
||||
run: |
|
||||
gh api /enterprises/my-enterprise-slug/apps/installable_organizations
|
||||
env:
|
||||
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
||||
```
|
||||
|
||||
### Create a token with specific permissions
|
||||
|
||||
> [!NOTE]
|
||||
> Selected permissions must be granted to the specified app installation. Setting a permission that the installation does not have will result in an error.
|
||||
> Selected permissions must be granted to the installation of the specified app and repository owner. Setting a permission that the installation does not have will result in an error.
|
||||
|
||||
```yaml
|
||||
on: [issues]
|
||||
@@ -229,14 +207,14 @@ jobs:
|
||||
hello-world:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/create-github-app-token@v3
|
||||
- uses: actions/create-github-app-token@v2
|
||||
id: app-token
|
||||
with:
|
||||
client-id: ${{ vars.APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
||||
app-id: ${{ vars.APP_ID }}
|
||||
private-key: ${{ secrets.PRIVATE_KEY }}
|
||||
owner: ${{ github.repository_owner }}
|
||||
permission-issues: write
|
||||
- uses: peter-evans/create-or-update-comment@v4
|
||||
- uses: peter-evans/create-or-update-comment@v3
|
||||
with:
|
||||
token: ${{ steps.app-token.outputs.token }}
|
||||
issue-number: ${{ github.event.issue.number }}
|
||||
@@ -271,11 +249,11 @@ jobs:
|
||||
owners-and-repos: ${{ fromJson(needs.set-matrix.outputs.matrix) }}
|
||||
|
||||
steps:
|
||||
- uses: actions/create-github-app-token@v3
|
||||
- uses: actions/create-github-app-token@v2
|
||||
id: app-token
|
||||
with:
|
||||
client-id: ${{ vars.APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
||||
app-id: ${{ vars.APP_ID }}
|
||||
private-key: ${{ secrets.PRIVATE_KEY }}
|
||||
owner: ${{ matrix.owners-and-repos.owner }}
|
||||
repositories: ${{ join(matrix.owners-and-repos.repos) }}
|
||||
- uses: octokit/request-action@v2.x
|
||||
@@ -301,9 +279,9 @@ jobs:
|
||||
steps:
|
||||
- name: Create GitHub App token
|
||||
id: create_token
|
||||
uses: actions/create-github-app-token@v3
|
||||
uses: actions/create-github-app-token@v2
|
||||
with:
|
||||
client-id: ${{ vars.GHES_APP_CLIENT_ID }}
|
||||
app-id: ${{ vars.GHES_APP_ID }}
|
||||
private-key: ${{ secrets.GHES_APP_PRIVATE_KEY }}
|
||||
owner: ${{ vars.GHES_INSTALLATION_ORG }}
|
||||
github-api-url: ${{ vars.GITHUB_API_URL }}
|
||||
@@ -318,32 +296,11 @@ jobs:
|
||||
GITHUB_TOKEN: ${{ steps.create_token.outputs.token }}
|
||||
```
|
||||
|
||||
### Proxy support
|
||||
|
||||
This action relies on Node.js native proxy support.
|
||||
|
||||
If you set `HTTP_PROXY` or `HTTPS_PROXY`, also set `NODE_USE_ENV_PROXY: "1"` on the action step so Node.js honors those variables. If you need proxy bypass rules, set `NO_PROXY` alongside them.
|
||||
|
||||
```yaml
|
||||
- uses: actions/create-github-app-token@v3
|
||||
id: app-token
|
||||
env:
|
||||
HTTPS_PROXY: http://proxy.example.com:8080
|
||||
NO_PROXY: github.example.com
|
||||
NODE_USE_ENV_PROXY: "1"
|
||||
with:
|
||||
client-id: ${{ vars.APP_CLIENT_ID }}
|
||||
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
||||
```
|
||||
|
||||
## Inputs
|
||||
|
||||
### `client-id` or `app-id`
|
||||
### `app-id`
|
||||
|
||||
**Required:** GitHub App Client ID.
|
||||
|
||||
> [!NOTE]
|
||||
> The legacy `app-id` input is also accepted, but `client-id` is recommended.
|
||||
**Required:** GitHub App ID.
|
||||
|
||||
### `private-key`
|
||||
|
||||
@@ -356,14 +313,14 @@ steps:
|
||||
- name: Decode the GitHub App Private Key
|
||||
id: decode
|
||||
run: |
|
||||
private_key=$(echo "${{ secrets.APP_PRIVATE_KEY }}" | base64 -d | awk 'BEGIN {ORS="\\n"} {print}' | head -c -2) &> /dev/null
|
||||
private_key=$(echo "${{ secrets.PRIVATE_KEY }}" | base64 -d | awk 'BEGIN {ORS="\\n"} {print}' | head -c -2) &> /dev/null
|
||||
echo "::add-mask::$private_key"
|
||||
echo "private-key=$private_key" >> "$GITHUB_OUTPUT"
|
||||
- name: Generate GitHub App Token
|
||||
id: app-token
|
||||
uses: actions/create-github-app-token@v3
|
||||
uses: actions/create-github-app-token@v2
|
||||
with:
|
||||
client-id: ${{ vars.APP_CLIENT_ID }}
|
||||
app-id: ${{ vars.APP_ID }}
|
||||
private-key: ${{ steps.decode.outputs.private-key }}
|
||||
```
|
||||
|
||||
@@ -378,13 +335,6 @@ steps:
|
||||
> [!NOTE]
|
||||
> If `owner` is set and `repositories` is empty, access will be scoped to all repositories in the provided repository owner's installation. If `owner` and `repositories` are empty, access will be scoped to only the current repository.
|
||||
|
||||
### `enterprise`
|
||||
|
||||
**Optional:** The slug of the enterprise account to generate a token for an enterprise installation.
|
||||
|
||||
> [!NOTE]
|
||||
> The `enterprise` input is mutually exclusive with `owner` and `repositories`. Use it when the GitHub App is installed on an enterprise account. Enterprise installation tokens can call enterprise APIs, but do not grant organization or repository access.
|
||||
|
||||
### `permission-<permission name>`
|
||||
|
||||
**Optional:** The permissions to grant to the token. By default, the token inherits all of the installation's permissions. We recommend to explicitly list the permissions that are required for a use case. This follows GitHub's own recommendation to [control permissions of `GITHUB_TOKEN` in workflows](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token). The documentation also lists all available permissions, just prefix the permission key with `permission-` (e.g., `pull-requests` → `permission-pull-requests`).
|
||||
@@ -415,14 +365,13 @@ GitHub App slug.
|
||||
|
||||
## How it works
|
||||
|
||||
The action creates an installation access token using [the `POST /app/installations/{installation_id}/access_tokens` endpoint](https://docs.github.com/rest/apps/apps?apiVersion=2022-11-28#create-an-installation-access-token-for-an-app).
|
||||
The action creates an installation access token using [the `POST /app/installations/{installation_id}/access_tokens` endpoint](https://docs.github.com/rest/apps/apps?apiVersion=2022-11-28#create-an-installation-access-token-for-an-app). By default,
|
||||
|
||||
The token target depends on the inputs: `enterprise` creates a token for an enterprise installation, `owner` without `repositories` creates a token for all repositories in the owner's installation, `repositories` scopes the token to those repositories, and no target inputs scopes the token to the current repository.
|
||||
|
||||
1. The token inherits all the installation's permissions.
|
||||
2. The token is set as output `token` which can be used in subsequent steps.
|
||||
3. Unless the `skip-token-revoke` input is set to true, the token is revoked in the `post` step of the action, which means it cannot be passed to another job.
|
||||
4. The token is masked, it cannot be logged accidentally.
|
||||
1. The token is scoped to the current repository or `repositories` if set.
|
||||
2. The token inherits all the installation's permissions.
|
||||
3. The token is set as output `token` which can be used in subsequent steps.
|
||||
4. Unless the `skip-token-revoke` input is set to true, the token is revoked in the `post` step of the action, which means it cannot be passed to another job.
|
||||
5. The token is masked, it cannot be logged accidentally.
|
||||
|
||||
> [!NOTE]
|
||||
> Installation permissions can differ from the app's permissions they belong to. Installation permissions are set when an app is installed on an account. When the app adds more permissions after the installation, an account administrator will have to approve the new permissions before they are set on the installation.
|
||||
|
||||
+2
-17
@@ -5,13 +5,9 @@ branding:
|
||||
icon: "lock"
|
||||
color: "gray-dark"
|
||||
inputs:
|
||||
client-id:
|
||||
description: "GitHub App Client ID"
|
||||
required: false
|
||||
app-id:
|
||||
description: "GitHub App ID"
|
||||
required: false
|
||||
deprecationMessage: "Use 'client-id' instead."
|
||||
required: true
|
||||
private-key:
|
||||
description: "GitHub App private key"
|
||||
required: true
|
||||
@@ -21,9 +17,6 @@ inputs:
|
||||
repositories:
|
||||
description: "Comma or newline-separated list of repositories to install the GitHub App on (defaults to current repository if owner is unset)"
|
||||
required: false
|
||||
enterprise:
|
||||
description: "The slug of the enterprise account where the GitHub App is installed (cannot be used with 'owner' or 'repositories')"
|
||||
required: false
|
||||
skip-token-revoke:
|
||||
description: "If true, the token will not be revoked when the current job is complete"
|
||||
required: false
|
||||
@@ -38,10 +31,6 @@ inputs:
|
||||
description: "The level of permission to grant the access token for GitHub Actions workflows, workflow runs, and artifacts. Can be set to 'read' or 'write'."
|
||||
permission-administration:
|
||||
description: "The level of permission to grant the access token for repository creation, deletion, settings, teams, and collaborators creation. Can be set to 'read' or 'write'."
|
||||
permission-artifact-metadata:
|
||||
description: "The level of permission to grant the access token to create and retrieve build artifact metadata records. Can be set to 'read' or 'write'."
|
||||
permission-attestations:
|
||||
description: "The level of permission to create and retrieve the access token for repository attestations. Can be set to 'read' or 'write'."
|
||||
permission-checks:
|
||||
description: "The level of permission to grant the access token for checks on code. Can be set to 'read' or 'write'."
|
||||
permission-codespaces:
|
||||
@@ -54,8 +43,6 @@ inputs:
|
||||
description: "The level of permission to grant the access token to manage Dependabot secrets. Can be set to 'read' or 'write'."
|
||||
permission-deployments:
|
||||
description: "The level of permission to grant the access token for deployments and deployment statuses. Can be set to 'read' or 'write'."
|
||||
permission-discussions:
|
||||
description: "The level of permission to grant the access token for discussions and related comments and labels. Can be set to 'read' or 'write'."
|
||||
permission-email-addresses:
|
||||
description: "The level of permission to grant the access token to manage the email addresses belonging to a user. Can be set to 'read' or 'write'."
|
||||
permission-enterprise-custom-properties-for-organizations:
|
||||
@@ -74,8 +61,6 @@ inputs:
|
||||
description: "The level of permission to grant the access token for issues and related comments, assignees, labels, and milestones. Can be set to 'read' or 'write'."
|
||||
permission-members:
|
||||
description: "The level of permission to grant the access token for organization teams and members. Can be set to 'read' or 'write'."
|
||||
permission-merge-queues:
|
||||
description: "The level of permission to grant the access token to manage the merge queues for a repository. Can be set to 'read' or 'write'."
|
||||
permission-metadata:
|
||||
description: "The level of permission to grant the access token to search repositories, list collaborators, and access repository metadata. Can be set to 'read' or 'write'."
|
||||
permission-organization-administration:
|
||||
@@ -151,6 +136,6 @@ outputs:
|
||||
app-slug:
|
||||
description: "GitHub App slug"
|
||||
runs:
|
||||
using: "node24"
|
||||
using: "node20"
|
||||
main: "dist/main.cjs"
|
||||
post: "dist/post.cjs"
|
||||
|
||||
Vendored
+32952
-11754
File diff suppressed because one or more lines are too long
Vendored
+32805
-11503
File diff suppressed because one or more lines are too long
+106
-160
@@ -1,11 +1,9 @@
|
||||
import pRetry from "p-retry";
|
||||
import isNetworkError from "is-network-error";
|
||||
// @ts-check
|
||||
|
||||
/**
|
||||
* @param {string} clientId
|
||||
* @param {string} appId
|
||||
* @param {string} privateKey
|
||||
* @param {string} enterprise
|
||||
* @param {string} owner
|
||||
* @param {string[]} repositories
|
||||
* @param {undefined | Record<string, string>} permissions
|
||||
@@ -15,34 +13,107 @@ import isNetworkError from "is-network-error";
|
||||
* @param {boolean} skipTokenRevoke
|
||||
*/
|
||||
export async function main(
|
||||
clientId,
|
||||
appId,
|
||||
privateKey,
|
||||
enterprise,
|
||||
owner,
|
||||
repositories,
|
||||
permissions,
|
||||
core,
|
||||
createAppAuth,
|
||||
request,
|
||||
skipTokenRevoke,
|
||||
skipTokenRevoke
|
||||
) {
|
||||
// Validate mutual exclusivity of enterprise with owner/repositories
|
||||
if (enterprise && (owner || repositories.length > 0)) {
|
||||
throw new Error("Cannot use 'enterprise' input with 'owner' or 'repositories' inputs");
|
||||
let parsedOwner = "";
|
||||
let parsedRepositoryNames = [];
|
||||
|
||||
// If neither owner nor repositories are set, default to current repository
|
||||
if (!owner && repositories.length === 0) {
|
||||
const [owner, repo] = String(process.env.GITHUB_REPOSITORY).split("/");
|
||||
parsedOwner = owner;
|
||||
parsedRepositoryNames = [repo];
|
||||
|
||||
core.info(
|
||||
`Inputs 'owner' and 'repositories' are not set. Creating token for this repository (${owner}/${repo}).`
|
||||
);
|
||||
}
|
||||
|
||||
const target = resolveInstallationTarget(enterprise, owner, repositories, core);
|
||||
// If only an owner is set, default to all repositories from that owner
|
||||
if (owner && repositories.length === 0) {
|
||||
parsedOwner = owner;
|
||||
|
||||
core.info(
|
||||
`Input 'repositories' is not set. Creating token for all repositories owned by ${owner}.`
|
||||
);
|
||||
}
|
||||
|
||||
// If repositories are set, but no owner, default to `GITHUB_REPOSITORY_OWNER`
|
||||
if (!owner && repositories.length > 0) {
|
||||
parsedOwner = String(process.env.GITHUB_REPOSITORY_OWNER);
|
||||
parsedRepositoryNames = repositories;
|
||||
|
||||
core.info(
|
||||
`No 'owner' input provided. Using default owner '${parsedOwner}' to create token for the following repositories:${repositories
|
||||
.map((repo) => `\n- ${parsedOwner}/${repo}`)
|
||||
.join("")}`
|
||||
);
|
||||
}
|
||||
|
||||
// If both owner and repositories are set, use those values
|
||||
if (owner && repositories.length > 0) {
|
||||
parsedOwner = owner;
|
||||
parsedRepositoryNames = repositories;
|
||||
|
||||
core.info(
|
||||
`Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
|
||||
${repositories.map((repo) => `\n- ${parsedOwner}/${repo}`).join("")}`
|
||||
);
|
||||
}
|
||||
|
||||
const auth = createAppAuth({
|
||||
appId: clientId,
|
||||
appId,
|
||||
privateKey,
|
||||
request,
|
||||
});
|
||||
|
||||
const { authentication, installationId, appSlug } = await pRetry(
|
||||
() => getTokenFromTarget(request, auth, target, permissions),
|
||||
createTokenRetryOptions(core, getTokenRetryDescription(target))
|
||||
);
|
||||
let authentication, installationId, appSlug;
|
||||
// If at least one repository is set, get installation ID from that repository
|
||||
|
||||
if (parsedRepositoryNames.length > 0) {
|
||||
({ authentication, installationId, appSlug } = await pRetry(
|
||||
() =>
|
||||
getTokenFromRepository(
|
||||
request,
|
||||
auth,
|
||||
parsedOwner,
|
||||
parsedRepositoryNames,
|
||||
permissions
|
||||
),
|
||||
{
|
||||
shouldRetry: ({ error }) => error.status >= 500,
|
||||
onFailedAttempt: (context) => {
|
||||
core.info(
|
||||
`Failed to create token for "${parsedRepositoryNames.join(
|
||||
","
|
||||
)}" (attempt ${context.attemptNumber}): ${context.error.message}`
|
||||
);
|
||||
},
|
||||
retries: 3,
|
||||
}
|
||||
));
|
||||
} else {
|
||||
// Otherwise get the installation for the owner, which can either be an organization or a user account
|
||||
({ authentication, installationId, appSlug } = await pRetry(
|
||||
() => getTokenFromOwner(request, auth, parsedOwner, permissions),
|
||||
{
|
||||
onFailedAttempt: (context) => {
|
||||
core.info(
|
||||
`Failed to create token for "${parsedOwner}" (attempt ${context.attemptNumber}): ${context.error.message}`
|
||||
);
|
||||
},
|
||||
retries: 3,
|
||||
}
|
||||
));
|
||||
}
|
||||
|
||||
// Register the token with the runner as a secret to ensure it is masked in logs
|
||||
core.setSecret(authentication.token);
|
||||
@@ -58,125 +129,6 @@ export async function main(
|
||||
}
|
||||
}
|
||||
|
||||
function resolveInstallationTarget(enterprise, owner, repositories, core) {
|
||||
if (enterprise) {
|
||||
core.info(`Creating enterprise installation token for enterprise "${enterprise}".`);
|
||||
return { type: "enterprise", enterprise };
|
||||
}
|
||||
|
||||
if (!owner && repositories.length === 0) {
|
||||
const [defaultOwner, repo] = String(process.env.GITHUB_REPOSITORY).split("/");
|
||||
|
||||
core.info(
|
||||
`Inputs 'owner' and 'repositories' are not set. Creating token for this repository (${defaultOwner}/${repo}).`
|
||||
);
|
||||
|
||||
return {
|
||||
type: "repository",
|
||||
owner: defaultOwner,
|
||||
repositories: [repo],
|
||||
};
|
||||
}
|
||||
|
||||
if (owner && repositories.length === 0) {
|
||||
core.info(
|
||||
`Input 'repositories' is not set. Creating token for all repositories owned by ${owner}.`
|
||||
);
|
||||
|
||||
return { type: "owner", owner };
|
||||
}
|
||||
|
||||
const parsedOwner = owner || String(process.env.GITHUB_REPOSITORY_OWNER);
|
||||
|
||||
if (!owner) {
|
||||
core.info(
|
||||
`No 'owner' input provided. Using default owner '${parsedOwner}' to create token for the following repositories:${repositories
|
||||
.map((repo) => `\n- ${parsedOwner}/${repo}`)
|
||||
.join("")}`
|
||||
);
|
||||
} else {
|
||||
core.info(
|
||||
`Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:${repositories
|
||||
.map((repo) => `\n- ${parsedOwner}/${repo}`)
|
||||
.join("")}`
|
||||
);
|
||||
}
|
||||
|
||||
return {
|
||||
type: "repository",
|
||||
owner: parsedOwner,
|
||||
repositories,
|
||||
};
|
||||
}
|
||||
|
||||
function getTokenRetryDescription(target) {
|
||||
switch (target.type) {
|
||||
case "enterprise":
|
||||
return `enterprise "${target.enterprise}"`;
|
||||
case "repository":
|
||||
return `"${target.repositories
|
||||
.map((repository) => `${target.owner}/${repository}`)
|
||||
.join(",")}"`;
|
||||
case "owner":
|
||||
return `"${target.owner}"`;
|
||||
/* c8 ignore next 2 */
|
||||
default:
|
||||
throw new Error(`Unsupported installation target type: ${target.type}`);
|
||||
}
|
||||
}
|
||||
|
||||
function getTokenFromTarget(request, auth, target, permissions) {
|
||||
switch (target.type) {
|
||||
case "enterprise":
|
||||
return getTokenFromEnterprise(request, auth, target.enterprise, permissions);
|
||||
case "repository":
|
||||
return getTokenFromRepository(
|
||||
request,
|
||||
auth,
|
||||
target.owner,
|
||||
target.repositories,
|
||||
permissions
|
||||
);
|
||||
case "owner":
|
||||
return getTokenFromOwner(request, auth, target.owner, permissions);
|
||||
/* c8 ignore next 2 */
|
||||
default:
|
||||
throw new Error(`Unsupported installation target type: ${target.type}`);
|
||||
}
|
||||
}
|
||||
|
||||
function createTokenRetryOptions(core, targetDescription) {
|
||||
return {
|
||||
shouldRetry: ({ error }) => error.status >= 500 || isNetworkError(error),
|
||||
onFailedAttempt: (context) => {
|
||||
core.info(
|
||||
`Failed to create token for ${targetDescription} (attempt ${context.attemptNumber}): ${context.error.message}`
|
||||
);
|
||||
},
|
||||
retries: 3,
|
||||
};
|
||||
}
|
||||
|
||||
async function createInstallationAuthResult(
|
||||
auth,
|
||||
installation,
|
||||
permissions,
|
||||
options = {},
|
||||
) {
|
||||
const authentication = await auth({
|
||||
type: "installation",
|
||||
installationId: installation.id,
|
||||
permissions,
|
||||
...options,
|
||||
});
|
||||
|
||||
return {
|
||||
authentication,
|
||||
installationId: installation.id,
|
||||
appSlug: installation["app_slug"],
|
||||
};
|
||||
}
|
||||
|
||||
async function getTokenFromOwner(request, auth, parsedOwner, permissions) {
|
||||
// https://docs.github.com/rest/apps/apps?apiVersion=2022-11-28#get-a-user-installation-for-the-authenticated-app
|
||||
// This endpoint works for both users and organizations
|
||||
@@ -187,8 +139,17 @@ async function getTokenFromOwner(request, auth, parsedOwner, permissions) {
|
||||
},
|
||||
});
|
||||
|
||||
// Get token for all repositories of the given installation
|
||||
return createInstallationAuthResult(auth, response.data, permissions);
|
||||
// Get token for for all repositories of the given installation
|
||||
const authentication = await auth({
|
||||
type: "installation",
|
||||
installationId: response.data.id,
|
||||
permissions,
|
||||
});
|
||||
|
||||
const installationId = response.data.id;
|
||||
const appSlug = response.data["app_slug"];
|
||||
|
||||
return { authentication, installationId, appSlug };
|
||||
}
|
||||
|
||||
async function getTokenFromRepository(
|
||||
@@ -208,30 +169,15 @@ async function getTokenFromRepository(
|
||||
});
|
||||
|
||||
// Get token for given repositories
|
||||
return createInstallationAuthResult(auth, response.data, permissions, {
|
||||
const authentication = await auth({
|
||||
type: "installation",
|
||||
installationId: response.data.id,
|
||||
repositoryNames: parsedRepositoryNames,
|
||||
permissions,
|
||||
});
|
||||
}
|
||||
|
||||
async function getTokenFromEnterprise(request, auth, enterprise, permissions) {
|
||||
let response;
|
||||
try {
|
||||
response = await request("GET /enterprises/{enterprise}/installation", {
|
||||
enterprise,
|
||||
request: {
|
||||
hook: auth.hook,
|
||||
},
|
||||
});
|
||||
} catch (error) {
|
||||
if (error.status === 404) {
|
||||
throw new Error(
|
||||
`No enterprise installation found matching the enterprise slug "${enterprise}".`
|
||||
);
|
||||
}
|
||||
|
||||
throw error;
|
||||
}
|
||||
|
||||
// Get token for the enterprise installation
|
||||
return createInstallationAuthResult(auth, response.data, permissions);
|
||||
|
||||
const installationId = response.data.id;
|
||||
const appSlug = response.data["app_slug"];
|
||||
|
||||
return { authentication, installationId, appSlug };
|
||||
}
|
||||
|
||||
+29
-24
@@ -1,36 +1,41 @@
|
||||
import * as core from "@actions/core";
|
||||
import core from "@actions/core";
|
||||
import { request } from "@octokit/request";
|
||||
import { ProxyAgent, fetch as undiciFetch } from "undici";
|
||||
|
||||
// Get the GitHub API URL from the action input and remove any trailing slash
|
||||
const baseUrl = core.getInput("github-api-url").replace(/\/$/, "");
|
||||
|
||||
const proxyEnvironmentKeys = [
|
||||
"https_proxy",
|
||||
"HTTPS_PROXY",
|
||||
"http_proxy",
|
||||
"HTTP_PROXY",
|
||||
];
|
||||
// https://docs.github.com/actions/hosting-your-own-runners/managing-self-hosted-runners/using-a-proxy-server-with-self-hosted-runners
|
||||
const proxyUrl =
|
||||
process.env.https_proxy ||
|
||||
process.env.HTTPS_PROXY ||
|
||||
process.env.http_proxy ||
|
||||
process.env.HTTP_PROXY;
|
||||
|
||||
function proxyEnvironmentConfigured() {
|
||||
return proxyEnvironmentKeys.some((key) => process.env[key]);
|
||||
}
|
||||
/* c8 ignore start */
|
||||
// Native support for proxies in Undici is under consideration: https://github.com/nodejs/undici/issues/1650
|
||||
// Until then, we need to use a custom fetch function to add proxy support.
|
||||
const proxyFetch = (url, options) => {
|
||||
const urlHost = new URL(url).hostname;
|
||||
const noProxy = (process.env.no_proxy || process.env.NO_PROXY || "").split(
|
||||
",",
|
||||
);
|
||||
|
||||
function nativeProxySupportEnabled() {
|
||||
return process.env.NODE_USE_ENV_PROXY === "1";
|
||||
}
|
||||
|
||||
export function ensureNativeProxySupport() {
|
||||
if (!proxyEnvironmentConfigured() || nativeProxySupportEnabled()) {
|
||||
return;
|
||||
if (!noProxy.includes(urlHost)) {
|
||||
options = {
|
||||
...options,
|
||||
dispatcher: new ProxyAgent(String(proxyUrl)),
|
||||
};
|
||||
}
|
||||
|
||||
throw new Error(
|
||||
"A proxy environment variable is set, but Node.js native proxy support is not enabled. Set NODE_USE_ENV_PROXY=1 for this action step.",
|
||||
);
|
||||
}
|
||||
return undiciFetch(url, options);
|
||||
};
|
||||
/* c8 ignore stop */
|
||||
|
||||
// Configure the default settings for GitHub API requests
|
||||
export default request.defaults({
|
||||
headers: { "user-agent": "actions/create-github-app-token" },
|
||||
headers: {
|
||||
"user-agent": "actions/create-github-app-token",
|
||||
},
|
||||
baseUrl,
|
||||
/* c8 ignore next */
|
||||
request: proxyUrl ? { fetch: proxyFetch } : {},
|
||||
});
|
||||
|
||||
@@ -0,0 +1,44 @@
|
||||
// @ts-check
|
||||
|
||||
import { spawn } from "node:child_process";
|
||||
|
||||
/**
|
||||
* Wraps a function to automatically enable Node.js proxy support when proxy
|
||||
* environment variables are detected. If proxy env vars are set but
|
||||
* `NODE_USE_ENV_PROXY` is not `"1"`, spawns a child process with
|
||||
* `NODE_USE_ENV_PROXY=1` to enable native proxy support.
|
||||
*
|
||||
* @param {() => Promise<void>} run
|
||||
* @returns {Promise<void>}
|
||||
*
|
||||
* @see https://github.com/nodejs/node/blob/4612c793cb9007a91cb3fd82afe518440473826e/lib/internal/process/pre_execution.js#L168-L187
|
||||
*/
|
||||
export async function runWithProxy(run) {
|
||||
const httpProxyEnvVars = [
|
||||
"https_proxy",
|
||||
"HTTPS_PROXY",
|
||||
"http_proxy",
|
||||
"HTTP_PROXY",
|
||||
];
|
||||
const nodeHasProxySupportEnabled = process.env.NODE_USE_ENV_PROXY === "1";
|
||||
const shouldUseProxy = httpProxyEnvVars.some((v) => process.env[v]);
|
||||
|
||||
if (!nodeHasProxySupportEnabled && shouldUseProxy) {
|
||||
return new Promise((resolve, reject) => {
|
||||
const child = spawn(process.execPath, process.argv.slice(1), {
|
||||
env: { ...process.env, NODE_USE_ENV_PROXY: "1" },
|
||||
stdio: "inherit",
|
||||
});
|
||||
child.on("exit", (code) => {
|
||||
process.exitCode = code;
|
||||
if (code !== 0) {
|
||||
reject(new Error(`Child process exited with code ${code}`));
|
||||
} else {
|
||||
resolve();
|
||||
}
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
return run();
|
||||
}
|
||||
@@ -1,11 +1,12 @@
|
||||
// @ts-check
|
||||
|
||||
import * as core from "@actions/core";
|
||||
import core from "@actions/core";
|
||||
import { createAppAuth } from "@octokit/auth-app";
|
||||
|
||||
import { getPermissionsFromInputs } from "./lib/get-permissions-from-inputs.js";
|
||||
import { main } from "./lib/main.js";
|
||||
import request, { ensureNativeProxySupport } from "./lib/request.js";
|
||||
import request from "./lib/request.js";
|
||||
import { runWithProxy } from "./lib/run-with-proxy.js";
|
||||
|
||||
if (!process.env.GITHUB_REPOSITORY) {
|
||||
throw new Error("GITHUB_REPOSITORY missing, must be set to '<owner>/<repo>'");
|
||||
@@ -15,15 +16,10 @@ if (!process.env.GITHUB_REPOSITORY_OWNER) {
|
||||
throw new Error("GITHUB_REPOSITORY_OWNER missing, must be set to '<owner>'");
|
||||
}
|
||||
|
||||
async function run() {
|
||||
ensureNativeProxySupport();
|
||||
|
||||
const clientId = core.getInput("client-id") || core.getInput("app-id");
|
||||
if (!clientId) {
|
||||
throw new Error("The 'client-id' (or deprecated 'app-id') input must be set to a non-empty string. If using a secret or variable, ensure it is available in this workflow context.");
|
||||
}
|
||||
// Export promise for testing
|
||||
export default runWithProxy(async () => {
|
||||
const appId = core.getInput("app-id");
|
||||
const privateKey = core.getInput("private-key");
|
||||
const enterprise = core.getInput("enterprise");
|
||||
const owner = core.getInput("owner");
|
||||
const repositories = core
|
||||
.getInput("repositories")
|
||||
@@ -36,9 +32,8 @@ async function run() {
|
||||
const permissions = getPermissionsFromInputs(process.env);
|
||||
|
||||
return main(
|
||||
clientId,
|
||||
appId,
|
||||
privateKey,
|
||||
enterprise,
|
||||
owner,
|
||||
repositories,
|
||||
permissions,
|
||||
@@ -46,12 +41,9 @@ async function run() {
|
||||
createAppAuth,
|
||||
request,
|
||||
skipTokenRevoke,
|
||||
);
|
||||
}
|
||||
|
||||
// Export promise for testing
|
||||
export default run().catch((error) => {
|
||||
/* c8 ignore next 3 */
|
||||
console.error(error);
|
||||
core.setFailed(error.message);
|
||||
).catch((error) => {
|
||||
/* c8 ignore next 3 */
|
||||
console.error(error);
|
||||
core.setFailed(error.message);
|
||||
});
|
||||
});
|
||||
|
||||
Generated
+2320
-393
File diff suppressed because it is too large
Load Diff
+46
-15
@@ -2,32 +2,63 @@
|
||||
"name": "create-github-app-token",
|
||||
"private": true,
|
||||
"type": "module",
|
||||
"version": "3.1.1",
|
||||
"version": "2.2.1",
|
||||
"description": "GitHub Action for creating a GitHub App Installation Access Token",
|
||||
"engines": {
|
||||
"node": ">=24.4.0"
|
||||
"node": ">=20"
|
||||
},
|
||||
"packageManager": "npm@10.9.4",
|
||||
"scripts": {
|
||||
"build": "esbuild main.js post.js --bundle --outdir=dist --out-extension:.js=.cjs --platform=node --packages=bundle",
|
||||
"test": "c8 --100 node --test tests/index.js",
|
||||
"build": "esbuild main.js post.js --bundle --outdir=dist --out-extension:.js=.cjs --platform=node --target=node20.0.0 --packages=bundle",
|
||||
"test": "c8 --100 ava tests/index.js",
|
||||
"coverage": "c8 report --reporter html",
|
||||
"postcoverage": "open-cli coverage/index.html"
|
||||
},
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@actions/core": "^3.0.1",
|
||||
"@octokit/auth-app": "^8.2.0",
|
||||
"@octokit/request": "^10.0.8",
|
||||
"is-network-error": "^1.3.2",
|
||||
"p-retry": "^8.0.0"
|
||||
"@actions/core": "^1.11.1",
|
||||
"@octokit/auth-app": "^8.1.2",
|
||||
"@octokit/request": "^10.0.3",
|
||||
"p-retry": "^7.1.0",
|
||||
"undici": "^7.16.0"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@octokit/openapi": "^22.0.0",
|
||||
"c8": "^11.0.0",
|
||||
"esbuild": "^0.28.0",
|
||||
"open-cli": "^9.0.0",
|
||||
"undici": "^8.2.0",
|
||||
"yaml": "^2.8.4"
|
||||
"@octokit/openapi": "^21.0.0",
|
||||
"@sinonjs/fake-timers": "^15.0.0",
|
||||
"ava": "^6.4.1",
|
||||
"c8": "^10.1.3",
|
||||
"dotenv": "^17.2.3",
|
||||
"esbuild": "^0.25.10",
|
||||
"execa": "^9.6.0",
|
||||
"open-cli": "^8.0.0",
|
||||
"yaml": "^2.8.1"
|
||||
},
|
||||
"release": {
|
||||
"branches": [
|
||||
"+([0-9]).x",
|
||||
"main",
|
||||
{
|
||||
"name": "beta",
|
||||
"prerelease": true
|
||||
}
|
||||
],
|
||||
"plugins": [
|
||||
"@semantic-release/commit-analyzer",
|
||||
"@semantic-release/release-notes-generator",
|
||||
"@semantic-release/github",
|
||||
"@semantic-release/npm",
|
||||
"semantic-release-plugin-github-breaking-version-tag",
|
||||
[
|
||||
"@semantic-release/git",
|
||||
{
|
||||
"assets": [
|
||||
"package.json",
|
||||
"package-lock.json",
|
||||
"dist/*"
|
||||
],
|
||||
"message": "build(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
|
||||
}
|
||||
]
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,18 +1,16 @@
|
||||
// @ts-check
|
||||
|
||||
import * as core from "@actions/core";
|
||||
import core from "@actions/core";
|
||||
|
||||
import { post } from "./lib/post.js";
|
||||
import request, { ensureNativeProxySupport } from "./lib/request.js";
|
||||
import request from "./lib/request.js";
|
||||
import { runWithProxy } from "./lib/run-with-proxy.js";
|
||||
|
||||
async function run() {
|
||||
ensureNativeProxySupport();
|
||||
|
||||
return post(core, request);
|
||||
}
|
||||
|
||||
run().catch((error) => {
|
||||
/* c8 ignore next 3 */
|
||||
console.error(error);
|
||||
core.setFailed(error.message);
|
||||
// Export promise for testing
|
||||
export default runWithProxy(async () => {
|
||||
return post(core, request).catch((error) => {
|
||||
/* c8 ignore next 3 */
|
||||
console.error(error);
|
||||
core.setFailed(error.message);
|
||||
});
|
||||
});
|
||||
|
||||
@@ -1,12 +0,0 @@
|
||||
{
|
||||
"$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
|
||||
"packages": {
|
||||
".": {
|
||||
"prerelease": true,
|
||||
"prerelease-type": "beta",
|
||||
"include-component-in-tag": false,
|
||||
"release-type": "node",
|
||||
"versioning": "prerelease"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
{
|
||||
"$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
|
||||
"packages": {
|
||||
".": {
|
||||
"include-component-in-tag": false,
|
||||
"release-type": "node"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -19,22 +19,6 @@
|
||||
"write"
|
||||
]
|
||||
},
|
||||
"artifact_metadata": {
|
||||
"type": "string",
|
||||
"description": "The level of permission to grant the access token to create and retrieve build artifact metadata records.",
|
||||
"enum": [
|
||||
"read",
|
||||
"write"
|
||||
]
|
||||
},
|
||||
"attestations": {
|
||||
"type": "string",
|
||||
"description": "The level of permission to create and retrieve the access token for repository attestations.",
|
||||
"enum": [
|
||||
"read",
|
||||
"write"
|
||||
]
|
||||
},
|
||||
"checks": {
|
||||
"type": "string",
|
||||
"description": "The level of permission to grant the access token for checks on code.",
|
||||
@@ -75,14 +59,6 @@
|
||||
"write"
|
||||
]
|
||||
},
|
||||
"discussions": {
|
||||
"type": "string",
|
||||
"description": "The level of permission to grant the access token for discussions and related comments and labels.",
|
||||
"enum": [
|
||||
"read",
|
||||
"write"
|
||||
]
|
||||
},
|
||||
"environments": {
|
||||
"type": "string",
|
||||
"description": "The level of permission to grant the access token for managing repository environments.",
|
||||
@@ -99,14 +75,6 @@
|
||||
"write"
|
||||
]
|
||||
},
|
||||
"merge_queues": {
|
||||
"type": "string",
|
||||
"description": "The level of permission to grant the access token to manage the merge queues for a repository.",
|
||||
"enum": [
|
||||
"read",
|
||||
"write"
|
||||
]
|
||||
},
|
||||
"metadata": {
|
||||
"type": "string",
|
||||
"description": "The level of permission to grant the access token to search repositories, list collaborators, and access repository metadata.",
|
||||
|
||||
+6
-12
@@ -2,14 +2,14 @@
|
||||
|
||||
Add one test file per scenario. You can run them in isolation with:
|
||||
|
||||
```
|
||||
```bash
|
||||
node tests/post-token-set.test.js
|
||||
```
|
||||
|
||||
All tests are run together in [tests/index.js](index.js), which can be executed with Node's built-in test runner
|
||||
All tests are run together in [tests/index.js](index.js), which can be executed with ava
|
||||
|
||||
```
|
||||
node --test tests/index.js
|
||||
npx ava tests/index.js
|
||||
```
|
||||
|
||||
or with npm
|
||||
@@ -20,17 +20,11 @@ npm test
|
||||
|
||||
## How the tests work
|
||||
|
||||
The output from the tests is captured into a snapshot ([tests/index.js.snapshot](index.js.snapshot)). It includes all requests sent by our scripts to verify it's working correctly and to prevent regressions.
|
||||
|
||||
To update snapshots after an intentional change:
|
||||
|
||||
```
|
||||
node --test --test-update-snapshots tests/index.js
|
||||
```
|
||||
The output from the tests is captured into a snapshot ([tests/snapshots/index.js.md](snapshots/index.js.md)). It includes all requests sent by our scripts to verify it's working correctly and to prevent regressions.
|
||||
|
||||
## How to add a new test
|
||||
|
||||
We have tests both for the `main.js` and `post.js` scripts.
|
||||
|
||||
- If you do not expect an error, take [main-token-permissions-set.test.js](main-token-permissions-set.test.js) as a starting point.
|
||||
- If your test has an expected error, take [main-missing-client-and-app-id.test.js](main-missing-client-and-app-id.test.js) as a starting point.
|
||||
- If you do not expect an error, take [main-token-permissions-set.test.js](tests/main-token-permissions-set.test.js) as a starting point.
|
||||
- If your test has an expected error, take [main-missing-app-id.test.js](tests/main-missing-app-id.test.js) as a starting point.
|
||||
|
||||
+19
-60
@@ -1,36 +1,15 @@
|
||||
import { readdirSync } from "node:fs";
|
||||
import { execFile } from "node:child_process";
|
||||
import { promisify } from "node:util";
|
||||
|
||||
import { snapshot, test } from "node:test";
|
||||
|
||||
const execFileAsync = promisify(execFile);
|
||||
|
||||
// Serialize strings as-is so multiline output is human-readable in snapshots
|
||||
snapshot.setDefaultSnapshotSerializers([
|
||||
(value) => (typeof value === "string" ? value : undefined),
|
||||
]);
|
||||
|
||||
function normalizeStderr(stderr) {
|
||||
return stderr
|
||||
.replaceAll(/\u001B\[[0-9;]*m/g, "")
|
||||
.replaceAll(process.cwd(), "<cwd>")
|
||||
.replaceAll(/:\d+:\d+/g, ":<line>:<column>");
|
||||
}
|
||||
import test from "ava";
|
||||
import { execa } from "execa";
|
||||
|
||||
// Get all files in tests directory
|
||||
const files = readdirSync("tests");
|
||||
|
||||
// Files to ignore
|
||||
const ignore = [
|
||||
"index.js",
|
||||
"index.js.snapshot",
|
||||
"main.js",
|
||||
"mock-agent.js",
|
||||
"README.md",
|
||||
];
|
||||
const ignore = ["index.js", "main.js", "README.md", "snapshots"];
|
||||
|
||||
const testFiles = files.filter((file) => !ignore.includes(file)).sort();
|
||||
const testFiles = files.filter((file) => !ignore.includes(file));
|
||||
|
||||
// Throw an error if there is a file that does not end with test.js in the tests directory
|
||||
for (const file of testFiles) {
|
||||
@@ -39,40 +18,20 @@ for (const file of testFiles) {
|
||||
}
|
||||
test(file, async (t) => {
|
||||
// Override Actions environment variables that change `core`’s behavior
|
||||
const {
|
||||
GITHUB_OUTPUT,
|
||||
GITHUB_STATE,
|
||||
HTTP_PROXY,
|
||||
HTTPS_PROXY,
|
||||
http_proxy,
|
||||
https_proxy,
|
||||
NO_PROXY,
|
||||
no_proxy,
|
||||
NODE_OPTIONS,
|
||||
NODE_USE_ENV_PROXY,
|
||||
...env
|
||||
} = process.env;
|
||||
let stderr, stdout;
|
||||
try {
|
||||
({ stderr, stdout } = await execFileAsync("node", [`tests/${file}`], {
|
||||
env,
|
||||
}));
|
||||
} catch (error) {
|
||||
if (!(error instanceof Error) || !("stderr" in error) || !("stdout" in error)) {
|
||||
throw error;
|
||||
}
|
||||
|
||||
({ stderr, stdout } = error);
|
||||
}
|
||||
const trimmedStderr = normalizeStderr(stderr).replace(/\r?\n$/, "");
|
||||
const trimmedStdout = stdout.replace(/\r?\n$/, "");
|
||||
await t.test("stderr", (t) => {
|
||||
if (trimmedStderr) t.assert.snapshot(trimmedStderr);
|
||||
else t.assert.strictEqual(trimmedStderr, "");
|
||||
});
|
||||
await t.test("stdout", (t) => {
|
||||
if (trimmedStdout) t.assert.snapshot(trimmedStdout);
|
||||
else t.assert.strictEqual(trimmedStdout, "");
|
||||
});
|
||||
const env = {
|
||||
GITHUB_OUTPUT: undefined,
|
||||
GITHUB_STATE: undefined,
|
||||
};
|
||||
const { stderr, stdout } = await execa(
|
||||
"node",
|
||||
[
|
||||
"--experimental-test-module-mocks",
|
||||
"--disable-warning=ExperimentalWarning",
|
||||
`tests/${file}`,
|
||||
],
|
||||
{ env },
|
||||
);
|
||||
t.snapshot(stderr, "stderr");
|
||||
t.snapshot(stdout, "stdout");
|
||||
});
|
||||
}
|
||||
|
||||
@@ -1,472 +0,0 @@
|
||||
exports[`action-deprecated-inputs.test.js > stdout 1`] = `
|
||||
app-id — Use 'client-id' instead.
|
||||
`;
|
||||
|
||||
exports[`main-app-id-fallback.test.js > stdout 1`] = `
|
||||
Inputs 'owner' and 'repositories' are not set. Creating token for this repository (actions/create-github-app-token).
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /repos/actions/create-github-app-token/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
{"repositories":["create-github-app-token"]}
|
||||
`;
|
||||
|
||||
exports[`main-client-id-precedence.test.js > stdout 1`] = `
|
||||
Inputs 'owner' and 'repositories' are not set. Creating token for this repository (actions/create-github-app-token).
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /repos/actions/create-github-app-token/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
{"repositories":["create-github-app-token"]}
|
||||
`;
|
||||
|
||||
exports[`main-custom-github-api-url.test.js > stdout 1`] = `
|
||||
Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
|
||||
- actions/create-github-app-token
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /api/v3/repos/actions/create-github-app-token/installation
|
||||
POST /api/v3/app/installations/123456/access_tokens
|
||||
{"repositories":["create-github-app-token"]}
|
||||
`;
|
||||
|
||||
exports[`main-enterprise-fail-response.test.js > stdout 1`] = `
|
||||
Creating enterprise installation token for enterprise "test-enterprise".
|
||||
Failed to create token for enterprise "test-enterprise" (attempt 1): GitHub API not available
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /enterprises/test-enterprise/installation
|
||||
GET /enterprises/test-enterprise/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
null
|
||||
`;
|
||||
|
||||
exports[`main-enterprise-installation-not-found.test.js > stderr 1`] = `
|
||||
Error: No enterprise installation found matching the enterprise slug "test-enterprise".
|
||||
at getTokenFromEnterprise (file://<cwd>/lib/main.js:<line>:<column>)
|
||||
at process.processTicksAndRejections (node:internal/process/task_queues:<line>:<column>)
|
||||
at async pRetry (file://<cwd>/node_modules/p-retry/index.js:<line>:<column>)
|
||||
at async main (file://<cwd>/lib/main.js:<line>:<column>)
|
||||
at async test (file://<cwd>/tests/main.js:<line>:<column>)
|
||||
at async file://<cwd>/tests/main-enterprise-installation-not-found.test.js:<line>:<column>
|
||||
`;
|
||||
|
||||
exports[`main-enterprise-installation-not-found.test.js > stdout 1`] = `
|
||||
Creating enterprise installation token for enterprise "test-enterprise".
|
||||
Failed to create token for enterprise "test-enterprise" (attempt 1): No enterprise installation found matching the enterprise slug "test-enterprise".
|
||||
::error::No enterprise installation found matching the enterprise slug "test-enterprise".
|
||||
--- REQUESTS ---
|
||||
GET /enterprises/test-enterprise/installation
|
||||
`;
|
||||
|
||||
exports[`main-enterprise-mutual-exclusivity-owner.test.js > stderr 1`] = `
|
||||
Error: Cannot use 'enterprise' input with 'owner' or 'repositories' inputs
|
||||
at main (file://<cwd>/lib/main.js:<line>:<column>)
|
||||
at run (file://<cwd>/main.js:<line>:<column>)
|
||||
at file://<cwd>/main.js:<line>:<column>
|
||||
at ModuleJob.run (node:internal/modules/esm/module_job:<line>:<column>)
|
||||
at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:<line>:<column>)
|
||||
at async file://<cwd>/tests/main-enterprise-mutual-exclusivity-owner.test.js:<line>:<column>
|
||||
`;
|
||||
|
||||
exports[`main-enterprise-mutual-exclusivity-owner.test.js > stdout 1`] = `
|
||||
::error::Cannot use 'enterprise' input with 'owner' or 'repositories' inputs
|
||||
`;
|
||||
|
||||
exports[`main-enterprise-mutual-exclusivity-repositories.test.js > stderr 1`] = `
|
||||
Error: Cannot use 'enterprise' input with 'owner' or 'repositories' inputs
|
||||
at main (file://<cwd>/lib/main.js:<line>:<column>)
|
||||
at run (file://<cwd>/main.js:<line>:<column>)
|
||||
at file://<cwd>/main.js:<line>:<column>
|
||||
at ModuleJob.run (node:internal/modules/esm/module_job:<line>:<column>)
|
||||
at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:<line>:<column>)
|
||||
at async file://<cwd>/tests/main-enterprise-mutual-exclusivity-repositories.test.js:<line>:<column>
|
||||
`;
|
||||
|
||||
exports[`main-enterprise-mutual-exclusivity-repositories.test.js > stdout 1`] = `
|
||||
::error::Cannot use 'enterprise' input with 'owner' or 'repositories' inputs
|
||||
`;
|
||||
|
||||
exports[`main-enterprise-only-success.test.js > stdout 1`] = `
|
||||
Creating enterprise installation token for enterprise "test-enterprise".
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /enterprises/test-enterprise/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
null
|
||||
`;
|
||||
|
||||
exports[`main-enterprise-token-permissions-set.test.js > stdout 1`] = `
|
||||
Creating enterprise installation token for enterprise "test-enterprise".
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /enterprises/test-enterprise/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
{"permissions":{"enterprise_custom_properties_for_organizations":"read"}}
|
||||
`;
|
||||
|
||||
exports[`main-missing-client-and-app-id.test.js > stderr 1`] = `
|
||||
The 'client-id' (or deprecated 'app-id') input must be set to a non-empty string. If using a secret or variable, ensure it is available in this workflow context.
|
||||
`;
|
||||
|
||||
exports[`main-missing-client-and-app-id.test.js > stdout 1`] = `
|
||||
::error::The 'client-id' (or deprecated 'app-id') input must be set to a non-empty string. If using a secret or variable, ensure it is available in this workflow context.
|
||||
`;
|
||||
|
||||
exports[`main-missing-owner.test.js > stderr 1`] = `
|
||||
GITHUB_REPOSITORY_OWNER missing, must be set to '<owner>'
|
||||
`;
|
||||
|
||||
exports[`main-missing-repository.test.js > stderr 1`] = `
|
||||
GITHUB_REPOSITORY missing, must be set to '<owner>/<repo>'
|
||||
`;
|
||||
|
||||
exports[`main-private-key-with-escaped-newlines.test.js > stdout 1`] = `
|
||||
Inputs 'owner' and 'repositories' are not set. Creating token for this repository (actions/create-github-app-token).
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /repos/actions/create-github-app-token/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
{"repositories":["create-github-app-token"]}
|
||||
`;
|
||||
|
||||
exports[`main-proxy-requires-native-support.test.js > stderr 1`] = `
|
||||
A proxy environment variable is set, but Node.js native proxy support is not enabled. Set NODE_USE_ENV_PROXY=1 for this action step.
|
||||
`;
|
||||
|
||||
exports[`main-proxy-requires-native-support.test.js > stdout 1`] = `
|
||||
::error::A proxy environment variable is set, but Node.js native proxy support is not enabled. Set NODE_USE_ENV_PROXY=1 for this action step.
|
||||
`;
|
||||
|
||||
exports[`main-repo-skew.test.js > stderr 1`] = `
|
||||
'Issued at' claim ('iat') must be an Integer representing the time that the assertion was issued.
|
||||
[@octokit/auth-app] GitHub API time and system time are different by 30 seconds. Retrying request with the difference accounted for.
|
||||
`;
|
||||
|
||||
exports[`main-repo-skew.test.js > stdout 1`] = `
|
||||
Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
|
||||
- actions/failed-repo
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /repos/actions/failed-repo/installation
|
||||
GET /repos/actions/failed-repo/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
{"repositories":["failed-repo"]}
|
||||
`;
|
||||
|
||||
exports[`main-token-get-owner-set-client-error.test.js > stderr 1`] = `
|
||||
RequestError [HttpError]: Forbidden
|
||||
at fetchWrapper (file://<cwd>/node_modules/@octokit/request/dist-bundle/index.js:<line>:<column>)
|
||||
at process.processTicksAndRejections (node:internal/process/task_queues:<line>:<column>)
|
||||
at async hook (file://<cwd>/node_modules/@octokit/auth-app/dist-node/index.js:<line>:<column>)
|
||||
at async getTokenFromOwner (file://<cwd>/lib/main.js:<line>:<column>)
|
||||
at async pRetry (file://<cwd>/node_modules/p-retry/index.js:<line>:<column>)
|
||||
at async main (file://<cwd>/lib/main.js:<line>:<column>)
|
||||
at async test (file://<cwd>/tests/main.js:<line>:<column>)
|
||||
at async file://<cwd>/tests/main-token-get-owner-set-client-error.test.js:<line>:<column> {
|
||||
status: 403,
|
||||
request: {
|
||||
method: 'GET',
|
||||
url: 'https://api.github.com/users/smockle/installation',
|
||||
headers: {
|
||||
accept: 'application/vnd.github.v3+json',
|
||||
'user-agent': 'actions/create-github-app-token',
|
||||
authorization: 'bearer [REDACTED]'
|
||||
},
|
||||
request: { hook: [Function: bound hook] AsyncFunction }
|
||||
},
|
||||
response: {
|
||||
url: 'https://api.github.com/users/smockle/installation',
|
||||
status: 403,
|
||||
headers: { 'content-type': 'application/json' },
|
||||
data: { message: 'Forbidden' }
|
||||
},
|
||||
[cause]: undefined
|
||||
}
|
||||
`;
|
||||
|
||||
exports[`main-token-get-owner-set-client-error.test.js > stdout 1`] = `
|
||||
Input 'repositories' is not set. Creating token for all repositories owned by smockle.
|
||||
Failed to create token for "smockle" (attempt 1): Forbidden
|
||||
::error::Forbidden
|
||||
--- REQUESTS ---
|
||||
GET /users/smockle/installation
|
||||
`;
|
||||
|
||||
exports[`main-token-get-owner-set-fail-response.test.js > stdout 1`] = `
|
||||
Input 'repositories' is not set. Creating token for all repositories owned by smockle.
|
||||
Failed to create token for "smockle" (attempt 1): GitHub API not available
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /users/smockle/installation
|
||||
GET /users/smockle/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
null
|
||||
`;
|
||||
|
||||
exports[`main-token-get-owner-set-repo-fail-response.test.js > stdout 1`] = `
|
||||
Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
|
||||
- actions/failed-repo
|
||||
Failed to create token for "actions/failed-repo" (attempt 1): GitHub API not available
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /repos/actions/failed-repo/installation
|
||||
GET /repos/actions/failed-repo/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
{"repositories":["failed-repo"]}
|
||||
`;
|
||||
|
||||
exports[`main-token-get-owner-set-repo-network-error.test.js > stdout 1`] = `
|
||||
Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
|
||||
- actions/network-repo
|
||||
Failed to create token for "actions/network-repo" (attempt 1): fetch failed
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /repos/actions/network-repo/installation
|
||||
GET /repos/actions/network-repo/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
{"repositories":["network-repo"]}
|
||||
`;
|
||||
|
||||
exports[`main-token-get-owner-set-repo-set-to-many-newline.test.js > stdout 1`] = `
|
||||
Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
|
||||
- actions/create-github-app-token
|
||||
- actions/toolkit
|
||||
- actions/checkout
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /repos/actions/create-github-app-token/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
{"repositories":["create-github-app-token","toolkit","checkout"]}
|
||||
`;
|
||||
|
||||
exports[`main-token-get-owner-set-repo-set-to-many.test.js > stdout 1`] = `
|
||||
Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
|
||||
- actions/create-github-app-token
|
||||
- actions/toolkit
|
||||
- actions/checkout
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /repos/actions/create-github-app-token/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
{"repositories":["create-github-app-token","toolkit","checkout"]}
|
||||
`;
|
||||
|
||||
exports[`main-token-get-owner-set-repo-set-to-one.test.js > stdout 1`] = `
|
||||
Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
|
||||
- actions/create-github-app-token
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /repos/actions/create-github-app-token/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
{"repositories":["create-github-app-token"]}
|
||||
`;
|
||||
|
||||
exports[`main-token-get-owner-set-repo-unset.test.js > stdout 1`] = `
|
||||
Input 'repositories' is not set. Creating token for all repositories owned by actions.
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /users/actions/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
null
|
||||
`;
|
||||
|
||||
exports[`main-token-get-owner-unset-repo-set.test.js > stdout 1`] = `
|
||||
No 'owner' input provided. Using default owner 'actions' to create token for the following repositories:
|
||||
- actions/create-github-app-token
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /repos/actions/create-github-app-token/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
{"repositories":["create-github-app-token"]}
|
||||
`;
|
||||
|
||||
exports[`main-token-get-owner-unset-repo-unset.test.js > stdout 1`] = `
|
||||
Inputs 'owner' and 'repositories' are not set. Creating token for this repository (actions/create-github-app-token).
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /repos/actions/create-github-app-token/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
{"repositories":["create-github-app-token"]}
|
||||
`;
|
||||
|
||||
exports[`main-token-permissions-set.test.js > stdout 1`] = `
|
||||
Inputs 'owner' and 'repositories' are not set. Creating token for this repository (actions/create-github-app-token).
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
|
||||
::set-output name=installation-id::123456
|
||||
|
||||
::set-output name=app-slug::github-actions
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z
|
||||
--- REQUESTS ---
|
||||
GET /repos/actions/create-github-app-token/installation
|
||||
POST /app/installations/123456/access_tokens
|
||||
{"repositories":["create-github-app-token"],"permissions":{"issues":"write","pull_requests":"read"}}
|
||||
`;
|
||||
|
||||
exports[`post-proxy-requires-native-support.test.js > stderr 1`] = `
|
||||
A proxy environment variable is set, but Node.js native proxy support is not enabled. Set NODE_USE_ENV_PROXY=1 for this action step.
|
||||
`;
|
||||
|
||||
exports[`post-proxy-requires-native-support.test.js > stdout 1`] = `
|
||||
::error::A proxy environment variable is set, but Node.js native proxy support is not enabled. Set NODE_USE_ENV_PROXY=1 for this action step.
|
||||
`;
|
||||
|
||||
exports[`post-revoke-token-fail-response.test.js > stdout 1`] = `
|
||||
::warning::Token revocation failed:
|
||||
`;
|
||||
|
||||
exports[`post-token-expired.test.js > stdout 1`] = `
|
||||
Token expired, skipping token revocation
|
||||
`;
|
||||
|
||||
exports[`post-token-set.test.js > stdout 1`] = `
|
||||
Token revoked
|
||||
`;
|
||||
|
||||
exports[`post-token-skipped.test.js > stdout 1`] = `
|
||||
Token revocation was skipped
|
||||
`;
|
||||
|
||||
exports[`post-token-unset.test.js > stdout 1`] = `
|
||||
Token is not set
|
||||
`;
|
||||
@@ -1,11 +0,0 @@
|
||||
import { DEFAULT_ENV, test } from "./main.js";
|
||||
|
||||
// Verify `main` falls back to `app-id` when `client-id` is not set
|
||||
await test(
|
||||
() => {},
|
||||
{
|
||||
...DEFAULT_ENV,
|
||||
"INPUT_CLIENT-ID": "",
|
||||
"INPUT_APP-ID": "123456",
|
||||
}
|
||||
);
|
||||
@@ -1,11 +0,0 @@
|
||||
import { DEFAULT_ENV, test } from "./main.js";
|
||||
|
||||
// Verify `client-id` takes precedence when both `client-id` and `app-id` are set
|
||||
await test(
|
||||
() => {},
|
||||
{
|
||||
...DEFAULT_ENV,
|
||||
"INPUT_CLIENT-ID": "Iv1.0123456789abcdef",
|
||||
"INPUT_APP-ID": "123456",
|
||||
}
|
||||
);
|
||||
@@ -1,39 +0,0 @@
|
||||
import { test } from "./main.js";
|
||||
|
||||
// Verify enterprise installation lookup retries when the GitHub API returns a 500 error.
|
||||
await test((mockPool) => {
|
||||
process.env.INPUT_ENTERPRISE = "test-enterprise";
|
||||
delete process.env.INPUT_OWNER;
|
||||
delete process.env.INPUT_REPOSITORIES;
|
||||
|
||||
const mockInstallationId = "123456";
|
||||
const mockAppSlug = "github-actions";
|
||||
|
||||
mockPool
|
||||
.intercept({
|
||||
path: "/enterprises/test-enterprise/installation",
|
||||
method: "GET",
|
||||
headers: {
|
||||
accept: "application/vnd.github.v3+json",
|
||||
"user-agent": "actions/create-github-app-token",
|
||||
// Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
|
||||
},
|
||||
})
|
||||
.reply(500, "GitHub API not available");
|
||||
|
||||
mockPool
|
||||
.intercept({
|
||||
path: "/enterprises/test-enterprise/installation",
|
||||
method: "GET",
|
||||
headers: {
|
||||
accept: "application/vnd.github.v3+json",
|
||||
"user-agent": "actions/create-github-app-token",
|
||||
// Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
|
||||
},
|
||||
})
|
||||
.reply(
|
||||
200,
|
||||
{ id: mockInstallationId, app_slug: mockAppSlug },
|
||||
{ headers: { "content-type": "application/json" } },
|
||||
);
|
||||
});
|
||||
@@ -1,25 +0,0 @@
|
||||
import { test } from "./main.js";
|
||||
|
||||
// Verify `main` handles when no enterprise installation is found.
|
||||
await test((mockPool) => {
|
||||
delete process.env.INPUT_OWNER;
|
||||
delete process.env.INPUT_REPOSITORIES;
|
||||
process.env.INPUT_ENTERPRISE = "test-enterprise";
|
||||
|
||||
// Mock the enterprise installation endpoint to return no matching installation
|
||||
mockPool
|
||||
.intercept({
|
||||
path: "/enterprises/test-enterprise/installation",
|
||||
method: "GET",
|
||||
headers: {
|
||||
accept: "application/vnd.github.v3+json",
|
||||
"user-agent": "actions/create-github-app-token",
|
||||
// Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
|
||||
},
|
||||
})
|
||||
.reply(
|
||||
404,
|
||||
{ message: "Not Found" },
|
||||
{ headers: { "content-type": "application/json" } }
|
||||
);
|
||||
});
|
||||
@@ -1,13 +0,0 @@
|
||||
import { DEFAULT_ENV } from "./main.js";
|
||||
|
||||
// Verify `main` exits with an error when `enterprise` is used with `owner` input.
|
||||
// Set up environment with enterprise and owner set
|
||||
for (const [key, value] of Object.entries(DEFAULT_ENV)) {
|
||||
process.env[key] = value;
|
||||
}
|
||||
|
||||
process.env.INPUT_ENTERPRISE = "test-enterprise";
|
||||
process.env.INPUT_OWNER = "test-owner";
|
||||
|
||||
const { default: promise } = await import("../main.js");
|
||||
await promise;
|
||||
@@ -1,13 +0,0 @@
|
||||
import { DEFAULT_ENV } from "./main.js";
|
||||
|
||||
// Verify `main` exits with an error when `enterprise` is used with `repositories` input.
|
||||
// Set up environment with enterprise and repositories set
|
||||
for (const [key, value] of Object.entries(DEFAULT_ENV)) {
|
||||
process.env[key] = value;
|
||||
}
|
||||
|
||||
process.env.INPUT_ENTERPRISE = "test-enterprise";
|
||||
process.env.INPUT_REPOSITORIES = "repo1,repo2";
|
||||
|
||||
const { default: promise } = await import("../main.js");
|
||||
await promise;
|
||||
@@ -1,30 +0,0 @@
|
||||
import { test } from "./main.js";
|
||||
|
||||
// Verify `main` successfully obtains a token when only the `enterprise` input is set.
|
||||
await test((mockPool) => {
|
||||
process.env.INPUT_ENTERPRISE = "test-enterprise";
|
||||
delete process.env.INPUT_OWNER;
|
||||
delete process.env.INPUT_REPOSITORIES;
|
||||
|
||||
// Mock the enterprise installation endpoint
|
||||
const mockInstallationId = "123456";
|
||||
const mockAppSlug = "github-actions";
|
||||
mockPool
|
||||
.intercept({
|
||||
path: "/enterprises/test-enterprise/installation",
|
||||
method: "GET",
|
||||
headers: {
|
||||
accept: "application/vnd.github.v3+json",
|
||||
"user-agent": "actions/create-github-app-token",
|
||||
// Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
|
||||
},
|
||||
})
|
||||
.reply(
|
||||
200,
|
||||
{
|
||||
id: mockInstallationId,
|
||||
app_slug: mockAppSlug,
|
||||
},
|
||||
{ headers: { "content-type": "application/json" } }
|
||||
);
|
||||
});
|
||||
@@ -1,34 +0,0 @@
|
||||
import { test } from "./main.js";
|
||||
|
||||
// Use a declared enterprise permission from the generated schema to verify
|
||||
// enterprise token requests forward permission inputs to token creation.
|
||||
await test((mockPool) => {
|
||||
process.env.INPUT_ENTERPRISE = "test-enterprise";
|
||||
delete process.env.INPUT_OWNER;
|
||||
delete process.env.INPUT_REPOSITORIES;
|
||||
process.env[
|
||||
"INPUT_PERMISSION-ENTERPRISE-CUSTOM-PROPERTIES-FOR-ORGANIZATIONS"
|
||||
] = "read";
|
||||
|
||||
// Mock the enterprise installation endpoint
|
||||
const mockInstallationId = "123456";
|
||||
const mockAppSlug = "github-actions";
|
||||
mockPool
|
||||
.intercept({
|
||||
path: "/enterprises/test-enterprise/installation",
|
||||
method: "GET",
|
||||
headers: {
|
||||
accept: "application/vnd.github.v3+json",
|
||||
"user-agent": "actions/create-github-app-token",
|
||||
// Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
|
||||
},
|
||||
})
|
||||
.reply(
|
||||
200,
|
||||
{
|
||||
id: mockInstallationId,
|
||||
app_slug: mockAppSlug,
|
||||
},
|
||||
{ headers: { "content-type": "application/json" } }
|
||||
);
|
||||
});
|
||||
@@ -1,20 +0,0 @@
|
||||
import { DEFAULT_ENV } from "./main.js";
|
||||
|
||||
for (const [key, value] of Object.entries({
|
||||
...DEFAULT_ENV,
|
||||
"INPUT_CLIENT-ID": "",
|
||||
"INPUT_APP-ID": "",
|
||||
})) {
|
||||
process.env[key] = value;
|
||||
}
|
||||
|
||||
// Log only the error message, not the full stack trace, because the stack
|
||||
// trace contains environment-specific paths and ANSI codes that differ
|
||||
// between local and CI environments.
|
||||
const _error = console.error;
|
||||
console.error = (err) => _error(err?.message ?? err);
|
||||
|
||||
// Verify `main` exits with an error when neither `client-id` nor `app-id` is set.
|
||||
const { default: promise } = await import("../main.js");
|
||||
await promise;
|
||||
process.exitCode = 0;
|
||||
@@ -0,0 +1,20 @@
|
||||
// Verify that `runWithProxy()` calls the callback directly (no child process)
|
||||
// when `NODE_USE_ENV_PROXY` is already set to `"1"`, even with proxy env vars set.
|
||||
import assert from "node:assert";
|
||||
import { runWithProxy } from "../lib/run-with-proxy.js";
|
||||
|
||||
process.env.https_proxy = "http://proxy.example.com";
|
||||
process.env.NODE_USE_ENV_PROXY = "1";
|
||||
|
||||
let callbackCalled = false;
|
||||
|
||||
await runWithProxy(async () => {
|
||||
callbackCalled = true;
|
||||
});
|
||||
|
||||
assert(callbackCalled, "callback was called directly without spawning");
|
||||
|
||||
delete process.env.NODE_USE_ENV_PROXY;
|
||||
delete process.env.https_proxy;
|
||||
|
||||
|
||||
@@ -0,0 +1,30 @@
|
||||
// Verify that `main.js` rejects when the child process exits with a non-zero code.
|
||||
import assert from "node:assert";
|
||||
import { mock } from "node:test";
|
||||
|
||||
mock.module("node:child_process", {
|
||||
namedExports: {
|
||||
spawn() {
|
||||
return {
|
||||
on(event, callback) {
|
||||
if (event === "exit") callback(1);
|
||||
},
|
||||
};
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
process.env.GITHUB_REPOSITORY = "actions/create-github-app-token";
|
||||
process.env.GITHUB_REPOSITORY_OWNER = "actions";
|
||||
process.env.https_proxy = "http://proxy.example.com";
|
||||
delete process.env.NODE_USE_ENV_PROXY;
|
||||
|
||||
const { default: runPromise } = await import("../main.js");
|
||||
|
||||
await assert.rejects(runPromise, {
|
||||
message: "Child process exited with code 1",
|
||||
});
|
||||
assert.equal(process.exitCode, 1, "process exit code is 1");
|
||||
|
||||
// Reset for other tests
|
||||
process.exitCode = 0;
|
||||
@@ -1,14 +0,0 @@
|
||||
process.env.GITHUB_REPOSITORY = "actions/create-github-app-token";
|
||||
process.env.GITHUB_REPOSITORY_OWNER = "actions";
|
||||
process.env.HTTPS_PROXY = "http://127.0.0.1:3128";
|
||||
|
||||
const originalConsoleError = console.error;
|
||||
console.error = (...args) => {
|
||||
originalConsoleError(
|
||||
...args.map((arg) => (arg instanceof Error ? arg.message : arg)),
|
||||
);
|
||||
};
|
||||
|
||||
await import("../main.js");
|
||||
await new Promise((resolve) => setImmediate(resolve));
|
||||
process.exitCode = 0;
|
||||
@@ -0,0 +1,36 @@
|
||||
// Verify that `main.js` spawns a child process when a proxy env var is set
|
||||
// and `NODE_USE_ENV_PROXY` is not set.
|
||||
import assert from "node:assert";
|
||||
import { mock } from "node:test";
|
||||
|
||||
let spawnArgs;
|
||||
|
||||
mock.module("node:child_process", {
|
||||
namedExports: {
|
||||
spawn(command, args, options) {
|
||||
spawnArgs = { command, args, options };
|
||||
return {
|
||||
on(event, callback) {
|
||||
if (event === "exit") callback(0);
|
||||
},
|
||||
};
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
process.env.GITHUB_REPOSITORY = "actions/create-github-app-token";
|
||||
process.env.GITHUB_REPOSITORY_OWNER = "actions";
|
||||
process.env.https_proxy = "http://proxy.example.com";
|
||||
delete process.env.NODE_USE_ENV_PROXY;
|
||||
|
||||
const { default: runPromise } = await import("../main.js");
|
||||
await runPromise;
|
||||
|
||||
assert(spawnArgs, "spawn was called");
|
||||
assert.equal(
|
||||
spawnArgs.options.env.NODE_USE_ENV_PROXY,
|
||||
"1",
|
||||
"NODE_USE_ENV_PROXY is set to '1' in child env",
|
||||
);
|
||||
assert.equal(spawnArgs.options.stdio, "inherit", "stdio is inherited");
|
||||
assert.equal(process.exitCode, 0, "process exit code is 0");
|
||||
@@ -1,7 +1,7 @@
|
||||
import { mock } from "node:test";
|
||||
|
||||
import { test } from "./main.js";
|
||||
|
||||
import { install } from "@sinonjs/fake-timers";
|
||||
|
||||
// Verify `main` retry when the clock has drifted.
|
||||
await test((mockPool) => {
|
||||
process.env.INPUT_OWNER = "actions";
|
||||
@@ -11,7 +11,7 @@ await test((mockPool) => {
|
||||
const mockInstallationId = "123456";
|
||||
const mockAppSlug = "github-actions";
|
||||
|
||||
mock.timers.enable({ apis: ["Date"], now: 0 });
|
||||
install({ now: 0, toFake: ["Date"] });
|
||||
|
||||
mockPool
|
||||
.intercept({
|
||||
@@ -59,6 +59,4 @@ await test((mockPool) => {
|
||||
};
|
||||
})
|
||||
.times(2);
|
||||
}).finally(() => {
|
||||
mock.timers.reset();
|
||||
});
|
||||
|
||||
@@ -1,23 +0,0 @@
|
||||
import { test } from "./main.js";
|
||||
|
||||
// Verify client errors are not retried when getting a token for a user or organization.
|
||||
await test((mockPool) => {
|
||||
process.env.INPUT_OWNER = "smockle";
|
||||
delete process.env.INPUT_REPOSITORIES;
|
||||
|
||||
mockPool
|
||||
.intercept({
|
||||
path: "/users/smockle/installation",
|
||||
method: "GET",
|
||||
headers: {
|
||||
accept: "application/vnd.github.v3+json",
|
||||
"user-agent": "actions/create-github-app-token",
|
||||
// Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
|
||||
},
|
||||
})
|
||||
.reply(
|
||||
403,
|
||||
{ message: "Forbidden" },
|
||||
{ headers: { "content-type": "application/json" } },
|
||||
);
|
||||
});
|
||||
@@ -1,39 +0,0 @@
|
||||
import { test } from "./main.js";
|
||||
|
||||
// Verify transient network errors are retried when getting a repository token.
|
||||
await test((mockPool) => {
|
||||
process.env.INPUT_OWNER = "actions";
|
||||
process.env.INPUT_REPOSITORIES = "network-repo";
|
||||
const owner = process.env.INPUT_OWNER;
|
||||
const repo = process.env.INPUT_REPOSITORIES;
|
||||
const mockInstallationId = "123456";
|
||||
const mockAppSlug = "github-actions";
|
||||
|
||||
mockPool
|
||||
.intercept({
|
||||
path: `/repos/${owner}/${repo}/installation`,
|
||||
method: "GET",
|
||||
headers: {
|
||||
accept: "application/vnd.github.v3+json",
|
||||
"user-agent": "actions/create-github-app-token",
|
||||
// Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
|
||||
},
|
||||
})
|
||||
.replyWithError(new TypeError("fetch failed"));
|
||||
|
||||
mockPool
|
||||
.intercept({
|
||||
path: `/repos/${owner}/${repo}/installation`,
|
||||
method: "GET",
|
||||
headers: {
|
||||
accept: "application/vnd.github.v3+json",
|
||||
"user-agent": "actions/create-github-app-token",
|
||||
// Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
|
||||
},
|
||||
})
|
||||
.reply(
|
||||
200,
|
||||
{ id: mockInstallationId, app_slug: mockAppSlug },
|
||||
{ headers: { "content-type": "application/json" } },
|
||||
);
|
||||
});
|
||||
+5
-3
@@ -1,6 +1,6 @@
|
||||
// Base for all `main` tests.
|
||||
// @ts-check
|
||||
import { createMockAgent } from "./mock-agent.js";
|
||||
import { MockAgent, setGlobalDispatcher } from "undici";
|
||||
|
||||
export const DEFAULT_ENV = {
|
||||
GITHUB_REPOSITORY_OWNER: "actions",
|
||||
@@ -9,7 +9,7 @@ export const DEFAULT_ENV = {
|
||||
// https://docs.github.com/actions/creating-actions/metadata-syntax-for-github-actions#example-specifying-inputs
|
||||
"INPUT_GITHUB-API-URL": "https://api.github.com",
|
||||
"INPUT_SKIP-TOKEN-REVOKE": "false",
|
||||
"INPUT_CLIENT-ID": "Iv1.0123456789abcdef",
|
||||
"INPUT_APP-ID": "123456",
|
||||
// This key is invalidated. It’s from https://github.com/octokit/auth-app.js/issues/465#issuecomment-1564998327.
|
||||
"INPUT_PRIVATE-KEY": `-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEowIBAAKCAQEA280nfuUM9w00Ib9E2rvZJ6Qu3Ua3IqR34ZlK53vn/Iobn2EL
|
||||
@@ -50,7 +50,9 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
|
||||
// Set up mocking
|
||||
const baseUrl = new URL(env["INPUT_GITHUB-API-URL"]);
|
||||
const basePath = baseUrl.pathname === "/" ? "" : baseUrl.pathname;
|
||||
const mockAgent = createMockAgent({ enableCallHistory: true });
|
||||
const mockAgent = new MockAgent({ enableCallHistory: true });
|
||||
mockAgent.disableNetConnect();
|
||||
setGlobalDispatcher(mockAgent);
|
||||
const mockPool = mockAgent.get(baseUrl.origin);
|
||||
|
||||
// Calling `auth({ type: "app" })` to obtain a JWT doesn’t make network requests, so no need to intercept.
|
||||
|
||||
@@ -1,12 +0,0 @@
|
||||
import { install, MockAgent, setGlobalDispatcher } from "undici";
|
||||
|
||||
// Ensure MockAgent intercepts requests made through global fetch.
|
||||
install();
|
||||
|
||||
export function createMockAgent(options) {
|
||||
const mockAgent = new MockAgent(options);
|
||||
mockAgent.disableNetConnect();
|
||||
setGlobalDispatcher(mockAgent);
|
||||
|
||||
return mockAgent;
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
// Verify that `runWithProxy()` calls the callback directly (no child process)
|
||||
// when `NODE_USE_ENV_PROXY` is already set to `"1"`, even with proxy env vars set.
|
||||
// This ensures post.js would also follow the callback path.
|
||||
import assert from "node:assert";
|
||||
import { runWithProxy } from "../lib/run-with-proxy.js";
|
||||
|
||||
process.env.HTTP_PROXY = "http://proxy.example.com";
|
||||
process.env.NODE_USE_ENV_PROXY = "1";
|
||||
|
||||
let callbackCalled = false;
|
||||
|
||||
await runWithProxy(async () => {
|
||||
callbackCalled = true;
|
||||
});
|
||||
|
||||
assert(callbackCalled, "callback was called directly without spawning");
|
||||
|
||||
delete process.env.NODE_USE_ENV_PROXY;
|
||||
delete process.env.HTTP_PROXY;
|
||||
|
||||
|
||||
@@ -1,13 +0,0 @@
|
||||
process.env["INPUT_GITHUB-API-URL"] = "https://api.github.com";
|
||||
process.env.HTTPS_PROXY = "http://127.0.0.1:3128";
|
||||
|
||||
const originalConsoleError = console.error;
|
||||
console.error = (...args) => {
|
||||
originalConsoleError(
|
||||
...args.map((arg) => (arg instanceof Error ? arg.message : arg)),
|
||||
);
|
||||
};
|
||||
|
||||
await import("../post.js");
|
||||
await new Promise((resolve) => setImmediate(resolve));
|
||||
process.exitCode = 0;
|
||||
@@ -0,0 +1,34 @@
|
||||
// Verify that `post.js` spawns a child process when a proxy env var is set
|
||||
// and `NODE_USE_ENV_PROXY` is not set.
|
||||
import assert from "node:assert";
|
||||
import { mock } from "node:test";
|
||||
|
||||
let spawnArgs;
|
||||
|
||||
mock.module("node:child_process", {
|
||||
namedExports: {
|
||||
spawn(command, args, options) {
|
||||
spawnArgs = { command, args, options };
|
||||
return {
|
||||
on(event, callback) {
|
||||
if (event === "exit") callback(0);
|
||||
},
|
||||
};
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
process.env.https_proxy = "http://proxy.example.com";
|
||||
delete process.env.NODE_USE_ENV_PROXY;
|
||||
|
||||
const { default: runPromise } = await import("../post.js");
|
||||
await runPromise;
|
||||
|
||||
assert(spawnArgs, "spawn was called");
|
||||
assert.equal(
|
||||
spawnArgs.options.env.NODE_USE_ENV_PROXY,
|
||||
"1",
|
||||
"NODE_USE_ENV_PROXY is set to '1' in child env",
|
||||
);
|
||||
assert.equal(spawnArgs.options.stdio, "inherit", "stdio is inherited");
|
||||
assert.equal(process.exitCode, 0, "process exit code is 0");
|
||||
@@ -1,4 +1,4 @@
|
||||
import { createMockAgent } from "./mock-agent.js";
|
||||
import { MockAgent, setGlobalDispatcher } from "undici";
|
||||
|
||||
// state variables are set as environment variables with the prefix STATE_
|
||||
// https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#sending-values-to-the-pre-and-post-actions
|
||||
@@ -14,7 +14,9 @@ process.env.STATE_expiresAt = new Date(
|
||||
Date.now() + 1000 * 60 * 60
|
||||
).toISOString();
|
||||
|
||||
const mockAgent = createMockAgent();
|
||||
const mockAgent = new MockAgent();
|
||||
|
||||
setGlobalDispatcher(mockAgent);
|
||||
|
||||
// Provide the base url to the request
|
||||
const mockPool = mockAgent.get("https://api.github.com");
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
import { createMockAgent } from "./mock-agent.js";
|
||||
import { MockAgent, setGlobalDispatcher } from "undici";
|
||||
|
||||
// state variables are set as environment variables with the prefix STATE_
|
||||
// https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#sending-values-to-the-pre-and-post-actions
|
||||
@@ -11,7 +11,9 @@ process.env.STATE_expiresAt = new Date(Date.now() - 1000 * 60 * 60).toISOString(
|
||||
// https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#example-specifying-inputs
|
||||
process.env["INPUT_SKIP-TOKEN-REVOKE"] = "false";
|
||||
|
||||
const mockAgent = createMockAgent();
|
||||
const mockAgent = new MockAgent();
|
||||
|
||||
setGlobalDispatcher(mockAgent);
|
||||
|
||||
// Provide the base url to the request
|
||||
const mockPool = mockAgent.get("https://api.github.com");
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
import { createMockAgent } from "./mock-agent.js";
|
||||
import { MockAgent, setGlobalDispatcher } from "undici";
|
||||
|
||||
// state variables are set as environment variables with the prefix STATE_
|
||||
// https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#sending-values-to-the-pre-and-post-actions
|
||||
@@ -12,7 +12,9 @@ process.env["INPUT_SKIP-TOKEN-REVOKE"] = "false";
|
||||
// 1 hour in the future, not expired
|
||||
process.env.STATE_expiresAt = new Date(Date.now() + 1000 * 60 * 60).toISOString();
|
||||
|
||||
const mockAgent = createMockAgent();
|
||||
const mockAgent = new MockAgent();
|
||||
|
||||
setGlobalDispatcher(mockAgent);
|
||||
|
||||
// Provide the base url to the request
|
||||
const mockPool = mockAgent.get("https://api.github.com");
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
import { createMockAgent } from "./mock-agent.js";
|
||||
import { MockAgent, setGlobalDispatcher } from "undici";
|
||||
|
||||
// state variables are set as environment variables with the prefix STATE_
|
||||
// https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#sending-values-to-the-pre-and-post-actions
|
||||
@@ -8,7 +8,9 @@ process.env.STATE_token = "secret123";
|
||||
// https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#example-specifying-inputs
|
||||
process.env["INPUT_SKIP-TOKEN-REVOKE"] = "true";
|
||||
|
||||
const mockAgent = createMockAgent();
|
||||
const mockAgent = new MockAgent();
|
||||
|
||||
setGlobalDispatcher(mockAgent);
|
||||
|
||||
// Provide the base url to the request
|
||||
const mockPool = mockAgent.get("https://api.github.com");
|
||||
|
||||
@@ -0,0 +1,434 @@
|
||||
# Snapshot report for `tests/index.js`
|
||||
|
||||
The actual snapshot is saved in `index.js.snap`.
|
||||
|
||||
Generated by [AVA](https://avajs.dev).
|
||||
|
||||
## action-deprecated-inputs.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
''
|
||||
|
||||
## main-custom-github-api-url.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
`Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:␊
|
||||
␊
|
||||
- actions/create-github-app-token␊
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=installation-id::123456␊
|
||||
␊
|
||||
::set-output name=app-slug::github-actions␊
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z␊
|
||||
--- REQUESTS ---␊
|
||||
GET /api/v3/repos/actions/create-github-app-token/installation␊
|
||||
POST /api/v3/app/installations/123456/access_tokens␊
|
||||
{"repositories":["create-github-app-token"]}`
|
||||
|
||||
## main-missing-owner.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
'GITHUB_REPOSITORY_OWNER missing, must be set to \'<owner>\''
|
||||
|
||||
> stdout
|
||||
|
||||
''
|
||||
|
||||
## main-missing-repository.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
'GITHUB_REPOSITORY missing, must be set to \'<owner>/<repo>\''
|
||||
|
||||
> stdout
|
||||
|
||||
''
|
||||
|
||||
## main-private-key-with-escaped-newlines.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
`Inputs 'owner' and 'repositories' are not set. Creating token for this repository (actions/create-github-app-token).␊
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=installation-id::123456␊
|
||||
␊
|
||||
::set-output name=app-slug::github-actions␊
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z␊
|
||||
--- REQUESTS ---␊
|
||||
GET /repos/actions/create-github-app-token/installation␊
|
||||
POST /app/installations/123456/access_tokens␊
|
||||
{"repositories":["create-github-app-token"]}`
|
||||
|
||||
## main-proxy-already-enabled.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
''
|
||||
|
||||
## main-proxy-child-error.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
''
|
||||
|
||||
## main-proxy-spawns-child.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
''
|
||||
|
||||
## main-repo-skew.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
`'Issued at' claim ('iat') must be an Integer representing the time that the assertion was issued.␊
|
||||
[@octokit/auth-app] GitHub API time and system time are different by 30 seconds. Retrying request with the difference accounted for.`
|
||||
|
||||
> stdout
|
||||
|
||||
`Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:␊
|
||||
␊
|
||||
- actions/failed-repo␊
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=installation-id::123456␊
|
||||
␊
|
||||
::set-output name=app-slug::github-actions␊
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z␊
|
||||
--- REQUESTS ---␊
|
||||
GET /repos/actions/failed-repo/installation␊
|
||||
GET /repos/actions/failed-repo/installation␊
|
||||
POST /app/installations/123456/access_tokens␊
|
||||
{"repositories":["failed-repo"]}`
|
||||
|
||||
## main-token-get-owner-set-fail-response.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
`Input 'repositories' is not set. Creating token for all repositories owned by smockle.␊
|
||||
Failed to create token for "smockle" (attempt 1): GitHub API not available␊
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=installation-id::123456␊
|
||||
␊
|
||||
::set-output name=app-slug::github-actions␊
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z␊
|
||||
--- REQUESTS ---␊
|
||||
GET /users/smockle/installation␊
|
||||
GET /users/smockle/installation␊
|
||||
POST /app/installations/123456/access_tokens␊
|
||||
null`
|
||||
|
||||
## main-token-get-owner-set-repo-fail-response.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
`Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:␊
|
||||
␊
|
||||
- actions/failed-repo␊
|
||||
Failed to create token for "failed-repo" (attempt 1): GitHub API not available␊
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=installation-id::123456␊
|
||||
␊
|
||||
::set-output name=app-slug::github-actions␊
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z␊
|
||||
--- REQUESTS ---␊
|
||||
GET /repos/actions/failed-repo/installation␊
|
||||
GET /repos/actions/failed-repo/installation␊
|
||||
POST /app/installations/123456/access_tokens␊
|
||||
{"repositories":["failed-repo"]}`
|
||||
|
||||
## main-token-get-owner-set-repo-set-to-many-newline.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
`Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:␊
|
||||
␊
|
||||
- actions/create-github-app-token␊
|
||||
- actions/toolkit␊
|
||||
- actions/checkout␊
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=installation-id::123456␊
|
||||
␊
|
||||
::set-output name=app-slug::github-actions␊
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z␊
|
||||
--- REQUESTS ---␊
|
||||
GET /repos/actions/create-github-app-token/installation␊
|
||||
POST /app/installations/123456/access_tokens␊
|
||||
{"repositories":["create-github-app-token","toolkit","checkout"]}`
|
||||
|
||||
## main-token-get-owner-set-repo-set-to-many.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
`Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:␊
|
||||
␊
|
||||
- actions/create-github-app-token␊
|
||||
- actions/toolkit␊
|
||||
- actions/checkout␊
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=installation-id::123456␊
|
||||
␊
|
||||
::set-output name=app-slug::github-actions␊
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z␊
|
||||
--- REQUESTS ---␊
|
||||
GET /repos/actions/create-github-app-token/installation␊
|
||||
POST /app/installations/123456/access_tokens␊
|
||||
{"repositories":["create-github-app-token","toolkit","checkout"]}`
|
||||
|
||||
## main-token-get-owner-set-repo-set-to-one.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
`Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:␊
|
||||
␊
|
||||
- actions/create-github-app-token␊
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=installation-id::123456␊
|
||||
␊
|
||||
::set-output name=app-slug::github-actions␊
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z␊
|
||||
--- REQUESTS ---␊
|
||||
GET /repos/actions/create-github-app-token/installation␊
|
||||
POST /app/installations/123456/access_tokens␊
|
||||
{"repositories":["create-github-app-token"]}`
|
||||
|
||||
## main-token-get-owner-set-repo-unset.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
`Input 'repositories' is not set. Creating token for all repositories owned by actions.␊
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=installation-id::123456␊
|
||||
␊
|
||||
::set-output name=app-slug::github-actions␊
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z␊
|
||||
--- REQUESTS ---␊
|
||||
GET /users/actions/installation␊
|
||||
POST /app/installations/123456/access_tokens␊
|
||||
null`
|
||||
|
||||
## main-token-get-owner-unset-repo-set.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
`No 'owner' input provided. Using default owner 'actions' to create token for the following repositories:␊
|
||||
- actions/create-github-app-token␊
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=installation-id::123456␊
|
||||
␊
|
||||
::set-output name=app-slug::github-actions␊
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z␊
|
||||
--- REQUESTS ---␊
|
||||
GET /repos/actions/create-github-app-token/installation␊
|
||||
POST /app/installations/123456/access_tokens␊
|
||||
{"repositories":["create-github-app-token"]}`
|
||||
|
||||
## main-token-get-owner-unset-repo-unset.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
`Inputs 'owner' and 'repositories' are not set. Creating token for this repository (actions/create-github-app-token).␊
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=installation-id::123456␊
|
||||
␊
|
||||
::set-output name=app-slug::github-actions␊
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z␊
|
||||
--- REQUESTS ---␊
|
||||
GET /repos/actions/create-github-app-token/installation␊
|
||||
POST /app/installations/123456/access_tokens␊
|
||||
{"repositories":["create-github-app-token"]}`
|
||||
|
||||
## main-token-permissions-set.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
`Inputs 'owner' and 'repositories' are not set. Creating token for this repository (actions/create-github-app-token).␊
|
||||
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
␊
|
||||
::set-output name=installation-id::123456␊
|
||||
␊
|
||||
::set-output name=app-slug::github-actions␊
|
||||
::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
|
||||
::save-state name=expiresAt::2016-07-11T22:14:10Z␊
|
||||
--- REQUESTS ---␊
|
||||
GET /repos/actions/create-github-app-token/installation␊
|
||||
POST /app/installations/123456/access_tokens␊
|
||||
{"repositories":["create-github-app-token"],"permissions":{"issues":"write","pull_requests":"read"}}`
|
||||
|
||||
## post-proxy-already-enabled.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
''
|
||||
|
||||
## post-proxy-spawns-child.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
''
|
||||
|
||||
## post-revoke-token-fail-response.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
'::warning::Token revocation failed: '
|
||||
|
||||
## post-token-expired.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
'Token expired, skipping token revocation'
|
||||
|
||||
## post-token-set.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
'Token revoked'
|
||||
|
||||
## post-token-skipped.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
'Token revocation was skipped'
|
||||
|
||||
## post-token-unset.test.js
|
||||
|
||||
> stderr
|
||||
|
||||
''
|
||||
|
||||
> stdout
|
||||
|
||||
'Token is not set'
|
||||
Binary file not shown.
Reference in New Issue
Block a user