build(release): 1.2.2 [skip ci]

## [1.2.2](https://github.com/actions/create-github-app-token/compare/v1.2.1...v1.2.2) (2023-10-02)

### Bug Fixes

* **deps:** bump the production-dependencies group with 3 updates ([#51](https://github.com/actions/create-github-app-token/issues/51)) ([6d98b25](6d98b259d9)), closes [#1511](https://github.com/actions/create-github-app-token/issues/1511) [#535](https://github.com/actions/create-github-app-token/issues/535) [#535](https://github.com/actions/create-github-app-token/issues/535) [#533](https://github.com/actions/create-github-app-token/issues/533) [#531](https://github.com/actions/create-github-app-token/issues/531) [#530](https://github.com/actions/create-github-app-token/issues/530) [#524](https://github.com/actions/create-github-app-token/issues/524) [#637](https://github.com/actions/create-github-app-token/issues/637) [#637](https://github.com/actions/create-github-app-token/issues/637) [#631](https://github.com/actions/create-github-app-token/issues/631) [#626](https://github.com/actions/create-github-app-token/issues/626)

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @gr2m @parkerbxyz @actions/create-github-app-token-maintainers

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      production-dependencies:
+        dependency-type: "production"
+      development-dependencies:
+        dependency-type: "development"
+    commit-message:
+      prefix: "fix"
+      prefix-development: "build"
+      include: "scope"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"

.github/workflows/release.yml

@@ -14,24 +14,16 @@ jobs:
     name: release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/create-github-app-token@v1
-      - uses: actions/setup-node@v3
-        with:
-          cache: npm
-          node-version: lts/*
-      - run: npm ci
-      - run: npm run build
-      - uses: ./ # Uses the action in the root directory
         id: app-token
         with:
           app_id: ${{ vars.RELEASER_APP_ID }}
           private_key: ${{ secrets.RELEASER_APP_PRIVATE_KEY }}
-
+      - uses: actions/checkout@v4
-      - id: commit
-        uses: stefanzweifel/git-auto-commit-action@v4
         with:
-          commit_message: "build: update dist files"
+          token: ${{ steps.app-token.outputs.token }}
-      - run: npm i semantic-release-plugin-github-breaking-version-tag
+      - run: npm install --no-save @semantic-release/git semantic-release-plugin-github-breaking-version-tag
-      - run: npx semantic-release
+      - run: npm run build
+      - run: npx semantic-release --debug
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/test.yml

@@ -1,25 +1,49 @@
-on: [push]
+name: test
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
-  demo:
+  integration:
+    name: Integration
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: actions/setup-node@v3
         with:
-          node-version: '16.16'
+          node-version: 20
-          cache: 'npm'
+          cache: "npm"
+      - run: npm ci
+      - run: npm test
+
+  end-to-end:
+    name: End-to-End
+    runs-on: ubuntu-latest
+    # do not run from forks, as forks don’t have access to repository secrets
+    if: github.event.pull_request.head.repo.owner.login == github.event.pull_request.base.repo.owner.login
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 20
+          cache: "npm"
       - run: npm ci
       - run: npm run build
       - uses: ./ # Uses the action in the root directory
-        id: demo
+        id: test
         with:
-          app_id: ${{ secrets.APP_ID }}
+          app_id: ${{ vars.TEST_APP_ID }}
-          private_key: ${{ secrets.PRIVATE_KEY }}
+          private_key: ${{ secrets.TEST_APP_PRIVATE_KEY }}
       - uses: octokit/request-action@v2.x
         id: get-repository
         env:
-          GITHUB_TOKEN: ${{ steps.demo.outputs.token }}
+          GITHUB_TOKEN: ${{ steps.test.outputs.token }}
         with:
           route: GET /installation/repositories
       - run: echo '${{ steps.get-repository.outputs.data }}'

README.md

@@ -1,6 +1,6 @@
-# `gr2m/github-app-token-action`
+# Create GitHub App Token
 
-> GitHub Action for creating a GitHub App Installation Access Token
+GitHub Action for creating a GitHub App installation access token.
 
 ## Usage
 
@@ -19,7 +19,7 @@ jobs:
   hello-world:
     runs-on: ubuntu-latest
     steps:
-      - uses: gr2m/github-app-token-action@v1
+      - uses: actions/create-github-app-token@v1
         id: app-token
         with:
           app_id: ${{ vars.APP_ID }}
@@ -31,24 +31,6 @@ jobs:
           body: "Hello, World!"
 ```
 
-### Limit the app's permissions and access to repositories
-
-```yaml
-on: [issues]
-
-jobs:
-  with-scoped-token:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: gr2m/github-app-token-action@v1
-        id: app-token
-        with:
-          # required
-          app_id: ${{ vars.APP_ID }}
-          private_key: ${{ secrets.PRIVATE_KEY }}
-      # do something with the token
-```
-
 ### Use app token with `actions/checkout`
 
 ```yaml
@@ -58,7 +40,7 @@ jobs:
   auto-format:
     runs-on: ubuntu-latest
     steps:
-      - uses: gr2m/github-app-token-action@v1
+      - uses: actions/create-github-app-token@v1
         id: app-token
         with:
           # required
@@ -79,29 +61,29 @@ jobs:
 
 ### `app_id`
 
-**Required:** GitHub app ID.
+**Required:** GitHub App ID.
 
 ### `private_key`
 
-**Required:** GitHub app private key.
+**Required:** GitHub App private key.
 
 ## Outputs
 
 ### `token`
 
-GitHub installation access token.
+GitHub App installation access token.
 
 ## How it works
 
 The action creates an installation access token using [the `POST /app/installations/{installation_id}/access_tokens` endpoint](https://docs.github.com/rest/apps/apps?apiVersion=2022-11-28#create-an-installation-access-token-for-an-app). By default,
 
-1. The token is scoped to the current repository
+1. The token is scoped to the current repository.
-2. The token inherits all the installation's permissions
+2. The token inherits all the installation's permissions.
-3. The token is set as output `token` which can be used in subsequent steps
+3. The token is set as output `token` which can be used in subsequent steps.
 4. The token is revoked in the `post` step of the action, which means it cannot be passed to another job.
-5. The token is masked, it cannot be logged accidentally. That is not a feature by the action, but by the GitHub Actions runner itself, due to the specific format of GitHub tokens.
+5. The token is masked, it cannot be logged accidentally.
 
-> **Note**
+> [!NOTE]
 > Installation permissions can differ from the app's permissions they belong to. Installation permissions are set when an app is installed on an account. When the app adds more permissions after the installation, an account administrator will have to approve the new permissions before they are set on the installation.
 
 ## License

action.yml

@@ -1,17 +1,20 @@
-name: 'github-app-token'
+name: "Create GitHub App Token"
-description: ''
+description: "GitHub Action for creating a GitHub App installation access token"
-author: 'Gregor Martynus and Parker Brown'
+author: "Gregor Martynus and Parker Brown"
+branding:
+  icon: "lock"
+  color: "gray-dark"
 inputs:
   app_id:
-    description: 'GitHub app ID'
+    description: "GitHub App ID"
     required: true
   private_key:
-    description: 'GitHub app private key'
+    description: "GitHub App private key"
     required: true
 outputs:
   token:
-    description: 'GitHub installation access token'
+    description: "GitHub installation access token"
 runs:
-  using: 'node16'
+  using: "node20"
-  main: 'dist/main.cjs'
+  main: "dist/main.cjs"
-  post: 'dist/post.cjs'
+  post: "dist/post.cjs"

lib/main.js

@@ -1,16 +1,12 @@
 // @ts-check
 
-import core from "@actions/core";
-import { createAppAuth } from "@octokit/auth-app";
-import { request } from "@octokit/request";
-
 /**
  * @param {string} appId
  * @param {string} privateKey
  * @param {string} repository
- * @param {core} core
+ * @param {import("@actions/core")} core
- * @param {createAppAuth} createAppAuth
+ * @param {import("@octokit/auth-app").createAppAuth} createAppAuth
- * @param {request} request
+ * @param {import("@octokit/request").request} request
  */
 export async function main(
   appId,
@@ -26,6 +22,7 @@ export async function main(
   const auth = createAppAuth({
     appId,
     privateKey,
+    request,
   });
 
   const appAuthentication = await auth({
@@ -52,6 +49,9 @@ export async function main(
     repositoryNames: [repo],
   });
 
+  // Register the token with the runner as a secret to ensure it is masked in logs
+  core.setSecret(authentication.token);
+
   core.setOutput("token", authentication.token);
 
   // Make token accessible to post function (so we can invalidate it)

lib/post.js

@@ -1,15 +1,17 @@
 // @ts-check
 
-import core from "@actions/core";
-import { request } from "@octokit/request";
-
 /**
- * @param {core} core
+ * @param {import("@actions/core")} core
- * @param {request} request
+ * @param {import("@octokit/request").request} request
  */
 export async function post(core, request) {
   const token = core.getState("token");
 
+  if (!token) {
+    core.info("Token is not set");
+    return;
+  }
+
   await request("DELETE /installation/token", {
     headers: {
       authorization: `token ${token}`,

lib/request.js

@@ -0,0 +1,8 @@
+import { request } from "@octokit/request";
+
+export default request.defaults({
+  baseUrl: process.env["GITHUB_API_URL"],
+  headers: {
+    "user-agent": "actions/create-github-app-token",
+  },
+});

main.js

@@ -2,9 +2,9 @@
 
 import core from "@actions/core";
 import { createAppAuth } from "@octokit/auth-app";
-import { request } from "@octokit/request";
 
 import { main } from "./lib/main.js";
+import request from "./lib/request.js";
 
 if (!process.env.GITHUB_REPOSITORY) {
   throw new Error("GITHUB_REPOSITORY missing, must be set to '<owner>/<repo>'");
@@ -15,9 +15,16 @@ const privateKey = core.getInput("private_key");
 
 const repository = process.env.GITHUB_REPOSITORY;
 
-main(appId, privateKey, repository, core, createAppAuth, request).catch(
+main(
-  (error) => {
+  appId,
-    console.error(error);
+  privateKey,
-    core.setFailed(error.message);
+  repository,
-  }
+  core,
-);
+  createAppAuth,
+  request.defaults({
+    baseUrl: process.env["GITHUB_API_URL"],
+  })
+).catch((error) => {
+  console.error(error);
+  core.setFailed(error.message);
+});

package.json

@@ -1,27 +1,47 @@
 {
-  "name": "app-token-action",
+  "name": "create-github-app-token",
   "private": true,
   "type": "module",
-  "version": "1.0.0",
+  "version": "1.2.2",
   "description": "GitHub Action for creating a GitHub App Installation Access Token",
   "scripts": {
     "build": "esbuild main.js post.js --bundle --outdir=dist --out-extension:.js=.cjs --platform=node --target=node16.16",
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "test": "ava tests/index.js"
   },
   "license": "MIT",
   "dependencies": {
-    "@actions/core": "^1.10.0",
+    "@actions/core": "^1.10.1",
-    "@octokit/auth-app": "^4.0.13",
+    "@octokit/auth-app": "^6.0.1",
-    "@octokit/request": "^6.2.5"
+    "@octokit/request": "^8.1.2"
   },
   "devDependencies": {
-    "dotenv": "^16.0.3",
+    "ava": "^5.3.1",
-    "esbuild": "^0.17.19"
+    "dotenv": "^16.3.1",
+    "esbuild": "^0.19.4",
+    "execa": "^8.0.1",
+    "undici": "^5.25.2"
   },
   "release": {
     "branches": [
       "+([0-9]).x",
       "main"
+    ],
+    "plugins": [
+      "@semantic-release/commit-analyzer",
+      "@semantic-release/release-notes-generator",
+      "@semantic-release/github",
+      "@semantic-release/npm",
+      "semantic-release-plugin-github-breaking-version-tag",
+      [
+        "@semantic-release/git",
+        {
+          "assets": [
+            "package.json",
+            "dist/*"
+          ],
+          "message": "build(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+        }
+      ]
     ]
   }
 }

post.js

@@ -1,13 +1,16 @@
 // @ts-check
 
 import core from "@actions/core";
-import { request } from "@octokit/request";
 
 import { post } from "./lib/post.js";
+import request from "./lib/request.js";
 
-post(core, request).catch(
+post(
-  (error) => {
+  core,
-    console.error(error);
+  request.defaults({
-    core.setFailed(error.message);
+    baseUrl: process.env["GITHUB_API_URL"],
-  }
+  })
-);
+).catch((error) => {
+  console.error(error);
+  core.setFailed(error.message);
+});

tests/README.md

@@ -0,0 +1,19 @@
+# Tests
+
+Add one test file per scenario. You can run them in isolation with:
+
+```bash
+node tests/post-token-set.test.js
+```
+
+All tests are run together in [tests/index.js](index.js), which can be execauted with ava
+
+```
+npx ava tests/index.js
+```
+
+or with npm
+
+```
+npm test
+```

tests/index.js

@@ -0,0 +1,14 @@
+import { readdirSync } from "node:fs";
+
+import { execa } from "execa";
+import test from "ava";
+
+const tests = readdirSync("tests").filter((file) => file.endsWith(".test.js"));
+
+for (const file of tests) {
+  test(file, async (t) => {
+    const { stderr, stdout } = await execa("node", [`tests/${file}`]);
+    t.snapshot(stderr, "stderr");
+    t.snapshot(stdout, "stdout");
+  });
+}

tests/post-token-set.test.js

@@ -0,0 +1,25 @@
+import { MockAgent, setGlobalDispatcher } from "undici";
+
+// state variables are set as environment variables with the prefix STATE_
+// https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#sending-values-to-the-pre-and-post-actions
+process.env.STATE_token = "secret123";
+
+const mockAgent = new MockAgent();
+
+setGlobalDispatcher(mockAgent);
+
+// Provide the base url to the request
+const mockPool = mockAgent.get("https://api.github.com");
+
+// intercept the request
+mockPool
+  .intercept({
+    path: "/installation/token",
+    method: "DELETE",
+    headers: {
+      authorization: "token secret123",
+    },
+  })
+  .reply(204);
+
+await import("../post.js");

tests/post-token-unset.test.js

@@ -0,0 +1,5 @@
+// state variables are set as environment variables with the prefix STATE_
+// https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#sending-values-to-the-pre-and-post-actions
+delete process.env.STATE_token;
+
+await import("../post.js");

tests/snapshots/index.js.md

@@ -0,0 +1,25 @@
+# Snapshot report for `tests/index.js`
+
+The actual snapshot is saved in `index.js.snap`.
+
+Generated by [AVA](https://avajs.dev).
+
+## post-token-set.test.js
+
+> stderr
+
+    ''
+
+> stdout
+
+    'Token revoked'
+
+## post-token-unset.test.js
+
+> stderr
+
+    ''
+
+> stdout
+
+    'Token is not set'