Yuta Kasai
c3c17c79cc
This PR switches from evaluating values passed to `skip-token-revoke` as true if they are truthy in JavaScript, to using `getBooleanInput`. This change ensures that only proper YAML boolean values are recognized, preventing unintended evaluations to true. - The definition of `getBooleanInput` is here: definition of `core#getBooealnInput` is here: https://github.com/actions/toolkit/blob/930c89072712a3aac52d74b23338f00bb0cfcb24/packages/core/src/core.ts#L188-L208 The documentation states, `"If truthy, the token will not be revoked when the current job is complete"`, so this change could be considered a breaking change. This means that if there are users who rely on `truthy` and expect values like whitespace or `"false"` to be evaluated as true (though this is likely rare), it would be a breaking change. - `Boolean(" ")` and `Boolean("false")` are both evaluated as true. Alternatively, it can simply be considered a fix. How to handle this is up to the maintainer. Resolves https://github.com/actions/create-github-app-token/issues/216
47 lines
1.1 KiB
JavaScript
47 lines
1.1 KiB
JavaScript
// @ts-check
|
|
|
|
import core from "@actions/core";
|
|
import { createAppAuth } from "@octokit/auth-app";
|
|
|
|
import { getPermissionsFromInputs } from "./lib/get-permissions-from-inputs.js";
|
|
import { main } from "./lib/main.js";
|
|
import request from "./lib/request.js";
|
|
|
|
if (!process.env.GITHUB_REPOSITORY) {
|
|
throw new Error("GITHUB_REPOSITORY missing, must be set to '<owner>/<repo>'");
|
|
}
|
|
|
|
if (!process.env.GITHUB_REPOSITORY_OWNER) {
|
|
throw new Error("GITHUB_REPOSITORY_OWNER missing, must be set to '<owner>'");
|
|
}
|
|
|
|
const appId = core.getInput("app-id");
|
|
const privateKey = core.getInput("private-key");
|
|
const owner = core.getInput("owner");
|
|
const repositories = core
|
|
.getInput("repositories")
|
|
.split(/[\n,]+/)
|
|
.map((s) => s.trim())
|
|
.filter((x) => x !== "");
|
|
|
|
const skipTokenRevoke = core.getBooleanInput("skip-token-revoke");
|
|
|
|
const permissions = getPermissionsFromInputs(process.env);
|
|
|
|
// Export promise for testing
|
|
export default main(
|
|
appId,
|
|
privateKey,
|
|
owner,
|
|
repositories,
|
|
permissions,
|
|
core,
|
|
createAppAuth,
|
|
request,
|
|
skipTokenRevoke,
|
|
).catch((error) => {
|
|
/* c8 ignore next 3 */
|
|
console.error(error);
|
|
core.setFailed(error.message);
|
|
});
|