build(release): 1.1.4 [skip ci]

## [1.1.4](https://github.com/actions/create-github-app-token/compare/v1.1.3...v1.1.4) (2023-08-28) ### Bug Fixes * **release:** build `dist/` before release ([#33](https://github.com/actions/create-github-app-token/issues/33)) ([9a6a017](https://github.com/actions/create-github-app-token/commit/9a6a017c104eb1b36533ee8195e814f567934ce8)), closes [#32](https://github.com/actions/create-github-app-token/issues/32)
fix(release): build dist/ before release (#33 )
2023-08-28 22:29:27 +00:00 · 2023-08-28 15:28:55 -07:00 · 2023-08-28 15:14:31 -07:00 · 2023-08-25 21:51:50 -07:00
5 changed files with 1018 additions and 6754 deletions
@@ -23,6 +23,7 @@ jobs:
        with:
          token: ${{ steps.app-token.outputs.token }}
      - run: npm install --no-save @semantic-release/git semantic-release-plugin-github-breaking-version-tag
-      - run: npx semantic-release
+      - run: npm run build
+      - run: npx semantic-release --debug
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
@@ -81,7 +81,7 @@ The action creates an installation access token using [the `POST /app/installati
 2. The token inherits all the installation's permissions.
 3. The token is set as output `token` which can be used in subsequent steps.
 4. The token is revoked in the `post` step of the action, which means it cannot be passed to another job.
-5. The token is masked, it cannot be logged accidentally. That is not a feature by the action, but by the GitHub Actions runner itself, due to the specific format of GitHub tokens.
+5. The token is masked, it cannot be logged accidentally.

 > [!NOTE]
 > Installation permissions can differ from the app's permissions they belong to. Installation permissions are set when an app is installed on an account. When the app adds more permissions after the installation, an account administrator will have to approve the new permissions before they are set on the installation.
@@ -10,6 +10,8 @@ import { request } from "@octokit/request";
 export async function post(core, request) {
  const token = core.getState("token");

+  if (!token) return;
+  
  await request("DELETE /installation/token", {
    headers: {
      authorization: `token ${token}`,
Author	SHA1	Message	Date
semantic-release-bot	35d8ea9fdb	build(release): 1.1.4 [skip ci] ## [1.1.4](https://github.com/actions/create-github-app-token/compare/v1.1.3...v1.1.4) (2023-08-28) ### Bug Fixes * release: build `dist/` before release ([#33](https://github.com/actions/create-github-app-token/issues/33)) ([`9a6a017`](https://github.com/actions/create-github-app-token/commit/9a6a017c104eb1b36533ee8195e814f567934ce8)), closes [#32](https://github.com/actions/create-github-app-token/issues/32)	2023-08-28 22:29:27 +00:00
Gregor Martynus	9a6a017c10	fix(release): build `dist/` before release (#33 ) closes #32	2023-08-28 15:28:55 -07:00
David Sanders	2540ed49e5	fix: check for token before revoking (#30 ) Check before trying to revoke the token, in case the token generation failed. Otherwise the post step will throw an error. --------- Co-authored-by: Gregor Martynus <39992+gr2m@users.noreply.github.com>	2023-08-28 15:14:31 -07:00
Josh Gross	5611f921d9	docs(README): clarify token masking (#29 ) With #13, this action is explicitly masking the token so we don't need to mention that we're relying on a specific format of GitHub tokens being masked by the runner.	2023-08-25 21:51:50 -07:00