feat: Add a skip_token_revoke input for configuring token revocation (#54)
Fixes https://github.com/actions/create-github-app-token/issues/55 Currently, `actions/create-github-app-token` always/unconditionally revokes the installation access token in a `post` step, at the completion of the current job. This prevents tokens from being used in other jobs. This PR makes this behavior configurable: - When the `skip-token-revoke` input is not specified (i.e. by default), the token is revoked in a `post` step (i.e. the current behavior). - When the `skip-token-revoke` input is set to a truthy value (e.g. `"true"`[^1]), the token is not revoked in a `post` step. This PR adds a test for the `skip-token-revoke: "true"` case. This is configurable in other app token actions, e.g. [tibdex/github-app-token](3eb77c7243/README.md (L46-L47)) and [wow-actions/use-app-token](cd772994fc/README.md (L132)). [^1]: Note that `"false"` is also truthy: `Boolean("false")` is `true`. If we think that’ll potentially confuse folks, I can require `skip-token-revoke` to be set explicitly to `"true"`.
This commit is contained in:
5
dist/post.cjs
vendored
5
dist/post.cjs
vendored
@@ -2973,6 +2973,11 @@ var import_core = __toESM(require_core(), 1);
|
||||
|
||||
// lib/post.js
|
||||
async function post(core2, request2) {
|
||||
const skipTokenRevoke = Boolean(core2.getInput("skip_token_revoke"));
|
||||
if (skipTokenRevoke) {
|
||||
core2.info("Token revocation was skipped");
|
||||
return;
|
||||
}
|
||||
const token = core2.getState("token");
|
||||
if (!token) {
|
||||
core2.info("Token is not set");
|
||||
|
||||
Reference in New Issue
Block a user