Compare commits

..

7 Commits

Author SHA1 Message Date
semantic-release-bot
d28ad69b67 build(release): 3.0.0-beta.3 [skip ci]
# [3.0.0-beta.3](https://github.com/actions/create-github-app-token/compare/v3.0.0-beta.2...v3.0.0-beta.3) (2026-03-13)

### Bug Fixes

* require `NODE_USE_ENV_PROXY` for proxy support ([#342](https://github.com/actions/create-github-app-token/issues/342)) ([54e58b6](54e58b612c))
2026-03-13 06:19:27 +00:00
Parker Brown
54e58b612c fix: require NODE_USE_ENV_PROXY for proxy support (#342)
This PR switches proxy support to Node's native env-proxy handling and
makes the required configuration explicit.

## What changed

- fail fast in both `main` and `post` when proxy configuration is
present without `NODE_USE_ENV_PROXY=1`
- document the supported proxy configuration in `README.md`
- add regression tests for the proxy guard in both entrypoints
- keep the existing successful end-to-end coverage and add a smaller
proxy-specific workflow check that enables native proxy support, points
`https_proxy` at an unreachable proxy, and asserts the action fails
- update the test workflow so the same checks also run on pushes to
`beta`

## Proxy configuration

When using `HTTP_PROXY` or `HTTPS_PROXY`, set `NODE_USE_ENV_PROXY=1` on
the action step. If you need bypass rules, set `NO_PROXY` alongside
them.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-12 23:18:56 -07:00
semantic-release-bot
bf559f8544 build(release): 3.0.0-beta.2 [skip ci]
# [3.0.0-beta.2](https://github.com/actions/create-github-app-token/compare/v3.0.0-beta.1...v3.0.0-beta.2) (2025-08-22)

### Bug Fixes

* remove custom proxy handling ([#143](https://github.com/actions/create-github-app-token/issues/143)) ([cda91bf](cda91bf2b9)), closes [#134](https://github.com/actions/create-github-app-token/issues/134)
2025-08-22 19:16:51 +00:00
Parker Brown
cda91bf2b9 fix: remove custom proxy handling (#143)
Undici has added native support for proxy handling, so it is no longer necessary for us to have our own custom proxy handling.

Reverts #102 and resolves #134.
2025-08-22 12:16:16 -07:00
Parker Brown
2ae58da528 Disable semantic-release-plugin-github-breaking-version-tag
https://github.com/gr2m/semantic-release-plugin-update-version-in-files/issues/52
2025-08-15 13:03:02 -07:00
semantic-release-bot
fb1c7fda2b build(release): 3.0.0-beta.1 [skip ci]
# [3.0.0-beta.1](https://github.com/actions/create-github-app-token/compare/v2.1.1...v3.0.0-beta.1) (2025-08-15)

* feat!: node 24 support ([#275](https://github.com/actions/create-github-app-token/issues/275)) ([6178938](61789386cb))

### BREAKING CHANGES

* Requires [Actions Runner v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) or later if you are using a self-hosted runner.
2025-08-15 19:55:36 +00:00
Salman Chishti
61789386cb feat!: node 24 support (#275)
BREAKING CHANGE: Requires [Actions Runner v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) or later if you are using a self-hosted runner.

---------

Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
2025-08-15 12:55:04 -07:00
21 changed files with 23632 additions and 75089 deletions

View File

@@ -12,6 +12,6 @@ jobs:
id-token: write id-token: write
packages: write packages: write
steps: steps:
- uses: actions/checkout@v6 - uses: actions/checkout@v5
- name: Publish Immutable Action - name: Publish Immutable Action
uses: actions/publish-immutable-action@v0.0.4 uses: actions/publish-immutable-action@v0.0.4

View File

@@ -18,14 +18,14 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
# build local version to create token # build local version to create token
- uses: actions/checkout@v6 - uses: actions/checkout@v5
with: with:
persist-credentials: false persist-credentials: false
- uses: actions/setup-node@v6 - uses: actions/setup-node@v4
with: with:
node-version-file: package.json node-version-file: package.json
cache: 'npm'
- run: npm ci - run: npm ci
- run: npm run build - run: npm run build

View File

@@ -1,34 +0,0 @@
# This workflow warns and then closes issues that have had no activity for a specified amount of time.
# https://github.com/actions/stale
name: Stale
on:
workflow_dispatch:
schedule:
# 00:00 UTC on Mondays
- cron: '0 0 * * 1'
permissions:
issues: write
pull-requests: write
env:
DAYS_BEFORE_STALE: 180
DAYS_BEFORE_CLOSE: 60
STALE_LABEL: 'stale'
STALE_LABEL_URL: ${{github.server_url}}/${{github.repository}}/labels/stale
jobs:
stale:
runs-on: ubuntu-latest
steps:
- uses: actions/stale@v10
with:
operations-per-run: 100
days-before-stale: ${{ env.DAYS_BEFORE_STALE }}
days-before-close: ${{ env.DAYS_BEFORE_CLOSE }}
stale-issue-label: ${{ env.STALE_LABEL }}
stale-pr-label: ${{ env.STALE_LABEL }}
stale-issue-message: 'This issue has been marked ${{ env.STALE_LABEL_URL }} because it has been open for ${{ env.DAYS_BEFORE_STALE }} days with no activity. Please close this issue if it is no longer needed. If this issue is still relevant and you would like it to remain open, simply update it within the next ${{ env.DAYS_BEFORE_CLOSE }} days.'
stale-pr-message: 'This pull request has been marked ${{ env.STALE_LABEL_URL }} because it has been open for ${{ env.DAYS_BEFORE_STALE }} days with no activity. Please close this pull request if it is no longer needed. If this pull request is still relevant and you would like it to remain open, simply update it within the next ${{ env.DAYS_BEFORE_CLOSE }} days.'

View File

@@ -4,8 +4,8 @@ on:
push: push:
branches: branches:
- main - main
- beta
pull_request: pull_request:
merge_group:
workflow_dispatch: workflow_dispatch:
concurrency: concurrency:
@@ -17,28 +17,30 @@ permissions:
jobs: jobs:
integration: integration:
name: integration name: Integration
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v6 - uses: actions/checkout@v5
- uses: actions/setup-node@v6 - uses: actions/setup-node@v4
with: with:
node-version-file: package.json node-version-file: package.json
cache: 'npm'
- run: npm ci - run: npm ci
- run: npm test - run: npm test
end-to-end: end-to-end:
name: end-to-end name: End-to-End
runs-on: ubuntu-latest runs-on: ubuntu-latest
# do not run from forks, as forks dont have access to repository secrets # do not run from forks, as forks dont have access to repository secrets
if: github.event_name == 'merge_group' || github.event.pull_request.head.repo.owner.login == github.event.pull_request.base.repo.owner.login if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.owner.login == github.event.pull_request.base.repo.owner.login
steps: steps:
- uses: actions/checkout@v6 - uses: actions/checkout@v5
- uses: actions/setup-node@v6 - uses: actions/setup-node@v4
with: with:
node-version-file: package.json node-version-file: package.json
cache: 'npm'
- run: npm ci - run: npm ci
- run: npm run build - run: npm run build
- uses: ./ # Uses the action in the root directory - uses: ./ # Uses the action in the root directory
@@ -53,3 +55,28 @@ jobs:
with: with:
route: GET /installation/repositories route: GET /installation/repositories
- run: echo '${{ steps.get-repository.outputs.data }}' - run: echo '${{ steps.get-repository.outputs.data }}'
end-to-end-proxy:
name: End-to-End with unreachable proxy
runs-on: ubuntu-latest
# do not run from forks, as forks dont have access to repository secrets
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.owner.login == github.event.pull_request.base.repo.owner.login
steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v4
with:
node-version-file: package.json
cache: 'npm'
- run: npm ci
- run: npm run build
- uses: ./ # Uses the action in the root directory
continue-on-error: true
id: test
env:
NODE_USE_ENV_PROXY: "1"
https_proxy: http://127.0.0.1:9
with:
app-id: ${{ vars.TEST_APP_ID }}
private-key: ${{ secrets.TEST_APP_PRIVATE_KEY }}
- name: Assert action failed through unreachable proxy
run: test "${{ steps.test.outcome }}" = "failure"

View File

@@ -13,30 +13,21 @@ concurrency:
permissions: permissions:
contents: write contents: write
pull-requests: write
jobs: jobs:
update-permission-inputs: update-permission-inputs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
env:
COMMIT_MESSAGE: 'feat: update permission inputs'
steps: steps:
- uses: actions/checkout@v6 - uses: actions/checkout@v5
- uses: actions/setup-node@v6 - uses: actions/setup-node@v4
with: with:
node-version-file: package.json node-version-file: package.json
cache: 'npm'
- name: Install dependencies - name: Install dependencies
run: npm ci run: npm ci
- name: Run permission inputs update script - name: Run permission inputs update script
run: node scripts/update-permission-inputs.js run: node scripts/update-permission-inputs.js
- name: Commit changes - name: Commit changes
id: auto-commit uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
with: with:
commit_message: ${{ env.COMMIT_MESSAGE }} commit_message: 'feat: update permission inputs'
- name: Update PR title
if: github.event_name == 'pull_request' && steps.auto-commit.outputs.changes_detected == 'true'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
gh pr edit ${{ github.event.pull_request.number }} --title "${{ env.COMMIT_MESSAGE }}"

View File

@@ -28,7 +28,7 @@ jobs:
hello-world: hello-world:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/create-github-app-token@v2 - uses: actions/create-github-app-token@v3
id: app-token id: app-token
with: with:
app-id: ${{ vars.APP_ID }} app-id: ${{ vars.APP_ID }}
@@ -47,13 +47,13 @@ jobs:
auto-format: auto-format:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/create-github-app-token@v2 - uses: actions/create-github-app-token@v3
id: app-token id: app-token
with: with:
# required # required
app-id: ${{ vars.APP_ID }} app-id: ${{ vars.APP_ID }}
private-key: ${{ secrets.PRIVATE_KEY }} private-key: ${{ secrets.PRIVATE_KEY }}
- uses: actions/checkout@v4 - uses: actions/checkout@v5
with: with:
token: ${{ steps.app-token.outputs.token }} token: ${{ steps.app-token.outputs.token }}
ref: ${{ github.head_ref }} ref: ${{ github.head_ref }}
@@ -73,7 +73,7 @@ jobs:
auto-format: auto-format:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/create-github-app-token@v2 - uses: actions/create-github-app-token@v3
id: app-token id: app-token
with: with:
# required # required
@@ -98,7 +98,7 @@ jobs:
auto-format: auto-format:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/create-github-app-token@v2 - uses: actions/create-github-app-token@v3
id: app-token id: app-token
with: with:
# required # required
@@ -135,7 +135,7 @@ jobs:
hello-world: hello-world:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/create-github-app-token@v2 - uses: actions/create-github-app-token@v3
id: app-token id: app-token
with: with:
app-id: ${{ vars.APP_ID }} app-id: ${{ vars.APP_ID }}
@@ -157,7 +157,7 @@ jobs:
hello-world: hello-world:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/create-github-app-token@v2 - uses: actions/create-github-app-token@v3
id: app-token id: app-token
with: with:
app-id: ${{ vars.APP_ID }} app-id: ${{ vars.APP_ID }}
@@ -182,7 +182,7 @@ jobs:
hello-world: hello-world:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/create-github-app-token@v2 - uses: actions/create-github-app-token@v3
id: app-token id: app-token
with: with:
app-id: ${{ vars.APP_ID }} app-id: ${{ vars.APP_ID }}
@@ -207,7 +207,7 @@ jobs:
hello-world: hello-world:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/create-github-app-token@v2 - uses: actions/create-github-app-token@v3
id: app-token id: app-token
with: with:
app-id: ${{ vars.APP_ID }} app-id: ${{ vars.APP_ID }}
@@ -249,7 +249,7 @@ jobs:
owners-and-repos: ${{ fromJson(needs.set-matrix.outputs.matrix) }} owners-and-repos: ${{ fromJson(needs.set-matrix.outputs.matrix) }}
steps: steps:
- uses: actions/create-github-app-token@v2 - uses: actions/create-github-app-token@v3
id: app-token id: app-token
with: with:
app-id: ${{ vars.APP_ID }} app-id: ${{ vars.APP_ID }}
@@ -279,7 +279,7 @@ jobs:
steps: steps:
- name: Create GitHub App token - name: Create GitHub App token
id: create_token id: create_token
uses: actions/create-github-app-token@v2 uses: actions/create-github-app-token@v3
with: with:
app-id: ${{ vars.GHES_APP_ID }} app-id: ${{ vars.GHES_APP_ID }}
private-key: ${{ secrets.GHES_APP_PRIVATE_KEY }} private-key: ${{ secrets.GHES_APP_PRIVATE_KEY }}
@@ -296,6 +296,24 @@ jobs:
GITHUB_TOKEN: ${{ steps.create_token.outputs.token }} GITHUB_TOKEN: ${{ steps.create_token.outputs.token }}
``` ```
### Proxy support
This action relies on Node.js native proxy support.
If you set `HTTP_PROXY` or `HTTPS_PROXY`, also set `NODE_USE_ENV_PROXY: "1"` on the action step so Node.js honors those variables. If you need proxy bypass rules, set `NO_PROXY` alongside them.
```yaml
- uses: actions/create-github-app-token@v3
id: app-token
env:
HTTPS_PROXY: http://proxy.example.com:8080
NO_PROXY: github.example.com
NODE_USE_ENV_PROXY: "1"
with:
app-id: ${{ vars.APP_ID }}
private-key: ${{ secrets.PRIVATE_KEY }}
```
## Inputs ## Inputs
### `app-id` ### `app-id`
@@ -318,7 +336,7 @@ steps:
echo "private-key=$private_key" >> "$GITHUB_OUTPUT" echo "private-key=$private_key" >> "$GITHUB_OUTPUT"
- name: Generate GitHub App Token - name: Generate GitHub App Token
id: app-token id: app-token
uses: actions/create-github-app-token@v2 uses: actions/create-github-app-token@v3
with: with:
app-id: ${{ vars.APP_ID }} app-id: ${{ vars.APP_ID }}
private-key: ${{ steps.decode.outputs.private-key }} private-key: ${{ steps.decode.outputs.private-key }}

View File

@@ -37,16 +37,12 @@ inputs:
description: "The level of permission to grant the access token to create, edit, delete, and list Codespaces. Can be set to 'read' or 'write'." description: "The level of permission to grant the access token to create, edit, delete, and list Codespaces. Can be set to 'read' or 'write'."
permission-contents: permission-contents:
description: "The level of permission to grant the access token for repository contents, commits, branches, downloads, releases, and merges. Can be set to 'read' or 'write'." description: "The level of permission to grant the access token for repository contents, commits, branches, downloads, releases, and merges. Can be set to 'read' or 'write'."
permission-custom-properties-for-organizations:
description: "The level of permission to grant the access token to view and edit custom properties for an organization, when allowed by the property. Can be set to 'read' or 'write'."
permission-dependabot-secrets: permission-dependabot-secrets:
description: "The level of permission to grant the access token to manage Dependabot secrets. Can be set to 'read' or 'write'." description: "The level of permission to grant the access token to manage Dependabot secrets. Can be set to 'read' or 'write'."
permission-deployments: permission-deployments:
description: "The level of permission to grant the access token for deployments and deployment statuses. Can be set to 'read' or 'write'." description: "The level of permission to grant the access token for deployments and deployment statuses. Can be set to 'read' or 'write'."
permission-email-addresses: permission-email-addresses:
description: "The level of permission to grant the access token to manage the email addresses belonging to a user. Can be set to 'read' or 'write'." description: "The level of permission to grant the access token to manage the email addresses belonging to a user. Can be set to 'read' or 'write'."
permission-enterprise-custom-properties-for-organizations:
description: "The level of permission to grant the access token for organization custom properties management at the enterprise level. Can be set to 'read', 'write', or 'admin'."
permission-environments: permission-environments:
description: "The level of permission to grant the access token for managing repository environments. Can be set to 'read' or 'write'." description: "The level of permission to grant the access token for managing repository environments. Can be set to 'read' or 'write'."
permission-followers: permission-followers:
@@ -72,7 +68,7 @@ inputs:
permission-organization-custom-org-roles: permission-organization-custom-org-roles:
description: "The level of permission to grant the access token for custom organization roles management. Can be set to 'read' or 'write'." description: "The level of permission to grant the access token for custom organization roles management. Can be set to 'read' or 'write'."
permission-organization-custom-properties: permission-organization-custom-properties:
description: "The level of permission to grant the access token for repository custom properties management at the organization level. Can be set to 'read', 'write', or 'admin'." description: "The level of permission to grant the access token for custom property management. Can be set to 'read', 'write', or 'admin'."
permission-organization-custom-roles: permission-organization-custom-roles:
description: "The level of permission to grant the access token for custom repository roles management. Can be set to 'read' or 'write'." description: "The level of permission to grant the access token for custom repository roles management. Can be set to 'read' or 'write'."
permission-organization-events: permission-organization-events:
@@ -136,6 +132,6 @@ outputs:
app-slug: app-slug:
description: "GitHub App slug" description: "GitHub App slug"
runs: runs:
using: "node20" using: "node24"
main: "dist/main.cjs" main: "dist/main.cjs"
post: "dist/post.cjs" post: "dist/post.cjs"

48810
dist/main.cjs vendored

File diff suppressed because one or more lines are too long

48162
dist/post.cjs vendored

File diff suppressed because one or more lines are too long

View File

@@ -89,12 +89,12 @@ export async function main(
permissions permissions
), ),
{ {
shouldRetry: ({ error }) => error.status >= 500, shouldRetry: (error) => error.status >= 500,
onFailedAttempt: (context) => { onFailedAttempt: (error) => {
core.info( core.info(
`Failed to create token for "${parsedRepositoryNames.join( `Failed to create token for "${parsedRepositoryNames.join(
"," ","
)}" (attempt ${context.attemptNumber}): ${context.error.message}` )}" (attempt ${error.attemptNumber}): ${error.message}`
); );
}, },
retries: 3, retries: 3,
@@ -105,9 +105,9 @@ export async function main(
({ authentication, installationId, appSlug } = await pRetry( ({ authentication, installationId, appSlug } = await pRetry(
() => getTokenFromOwner(request, auth, parsedOwner, permissions), () => getTokenFromOwner(request, auth, parsedOwner, permissions),
{ {
onFailedAttempt: (context) => { onFailedAttempt: (error) => {
core.info( core.info(
`Failed to create token for "${parsedOwner}" (attempt ${context.attemptNumber}): ${context.error.message}` `Failed to create token for "${parsedOwner}" (attempt ${error.attemptNumber}): ${error.message}`
); );
}, },
retries: 3, retries: 3,

View File

@@ -1,41 +1,36 @@
import * as core from "@actions/core"; import core from "@actions/core";
import { request } from "@octokit/request"; import { request } from "@octokit/request";
import { ProxyAgent, fetch as undiciFetch } from "undici";
// Get the GitHub API URL from the action input and remove any trailing slash
const baseUrl = core.getInput("github-api-url").replace(/\/$/, ""); const baseUrl = core.getInput("github-api-url").replace(/\/$/, "");
// https://docs.github.com/actions/hosting-your-own-runners/managing-self-hosted-runners/using-a-proxy-server-with-self-hosted-runners const proxyEnvironmentKeys = [
const proxyUrl = "https_proxy",
process.env.https_proxy || "HTTPS_PROXY",
process.env.HTTPS_PROXY || "http_proxy",
process.env.http_proxy || "HTTP_PROXY",
process.env.HTTP_PROXY; ];
/* c8 ignore start */ function proxyEnvironmentConfigured() {
// Native support for proxies in Undici is under consideration: https://github.com/nodejs/undici/issues/1650 return proxyEnvironmentKeys.some((key) => process.env[key]);
// Until then, we need to use a custom fetch function to add proxy support. }
const proxyFetch = (url, options) => {
const urlHost = new URL(url).hostname;
const noProxy = (process.env.no_proxy || process.env.NO_PROXY || "").split(
",",
);
if (!noProxy.includes(urlHost)) { function nativeProxySupportEnabled() {
options = { return process.env.NODE_USE_ENV_PROXY === "1";
...options, }
dispatcher: new ProxyAgent(String(proxyUrl)),
}; export function ensureNativeProxySupport() {
if (!proxyEnvironmentConfigured() || nativeProxySupportEnabled()) {
return;
} }
return undiciFetch(url, options); throw new Error(
}; "A proxy environment variable is set, but Node.js native proxy support is not enabled. Set NODE_USE_ENV_PROXY=1 for this action step.",
/* c8 ignore stop */ );
}
// Configure the default settings for GitHub API requests
export default request.defaults({ export default request.defaults({
headers: { headers: { "user-agent": "actions/create-github-app-token" },
"user-agent": "actions/create-github-app-token",
},
baseUrl, baseUrl,
/* c8 ignore next */
request: proxyUrl ? { fetch: proxyFetch } : {},
}); });

52
main.js
View File

@@ -1,11 +1,11 @@
// @ts-check // @ts-check
import * as core from "@actions/core"; import core from "@actions/core";
import { createAppAuth } from "@octokit/auth-app"; import { createAppAuth } from "@octokit/auth-app";
import { getPermissionsFromInputs } from "./lib/get-permissions-from-inputs.js"; import { getPermissionsFromInputs } from "./lib/get-permissions-from-inputs.js";
import { main } from "./lib/main.js"; import { main } from "./lib/main.js";
import request from "./lib/request.js"; import request, { ensureNativeProxySupport } from "./lib/request.js";
if (!process.env.GITHUB_REPOSITORY) { if (!process.env.GITHUB_REPOSITORY) {
throw new Error("GITHUB_REPOSITORY missing, must be set to '<owner>/<repo>'"); throw new Error("GITHUB_REPOSITORY missing, must be set to '<owner>/<repo>'");
@@ -15,31 +15,37 @@ if (!process.env.GITHUB_REPOSITORY_OWNER) {
throw new Error("GITHUB_REPOSITORY_OWNER missing, must be set to '<owner>'"); throw new Error("GITHUB_REPOSITORY_OWNER missing, must be set to '<owner>'");
} }
const appId = core.getInput("app-id"); async function run() {
const privateKey = core.getInput("private-key"); ensureNativeProxySupport();
const owner = core.getInput("owner");
const repositories = core
.getInput("repositories")
.split(/[\n,]+/)
.map((s) => s.trim())
.filter((x) => x !== "");
const skipTokenRevoke = core.getBooleanInput("skip-token-revoke"); const appId = core.getInput("app-id");
const privateKey = core.getInput("private-key");
const owner = core.getInput("owner");
const repositories = core
.getInput("repositories")
.split(/[\n,]+/)
.map((s) => s.trim())
.filter((x) => x !== "");
const permissions = getPermissionsFromInputs(process.env); const skipTokenRevoke = core.getBooleanInput("skip-token-revoke");
const permissions = getPermissionsFromInputs(process.env);
return main(
appId,
privateKey,
owner,
repositories,
permissions,
core,
createAppAuth,
request,
skipTokenRevoke,
);
}
// Export promise for testing // Export promise for testing
export default main( export default run().catch((error) => {
appId,
privateKey,
owner,
repositories,
permissions,
core,
createAppAuth,
request,
skipTokenRevoke,
).catch((error) => {
/* c8 ignore next 3 */ /* c8 ignore next 3 */
console.error(error); console.error(error);
core.setFailed(error.message); core.setFailed(error.message);

1364
package-lock.json generated

File diff suppressed because it is too large Load Diff

View File

@@ -2,36 +2,35 @@
"name": "create-github-app-token", "name": "create-github-app-token",
"private": true, "private": true,
"type": "module", "type": "module",
"version": "2.2.2", "version": "3.0.0-beta.3",
"description": "GitHub Action for creating a GitHub App Installation Access Token", "description": "GitHub Action for creating a GitHub App Installation Access Token",
"engines": { "engines": {
"node": ">=20" "node": ">=24.4.0"
}, },
"packageManager": "npm@10.9.4",
"scripts": { "scripts": {
"build": "esbuild main.js post.js --bundle --outdir=dist --out-extension:.js=.cjs --platform=node --target=node20.0.0 --packages=bundle", "build": "esbuild main.js post.js --bundle --outdir=dist --out-extension:.js=.cjs --platform=node --packages=bundle",
"test": "c8 --100 ava tests/index.js", "test": "c8 --100 ava tests/index.js",
"coverage": "c8 report --reporter html", "coverage": "c8 report --reporter html",
"postcoverage": "open-cli coverage/index.html" "postcoverage": "open-cli coverage/index.html"
}, },
"license": "MIT", "license": "MIT",
"dependencies": { "dependencies": {
"@actions/core": "^3.0.0", "@actions/core": "^1.11.1",
"@octokit/auth-app": "^8.2.0", "@octokit/auth-app": "^7.2.1",
"@octokit/request": "^10.0.8", "@octokit/request": "^9.2.2",
"p-retry": "^7.1.1", "p-retry": "^6.2.1"
"undici": "^7.24.1"
}, },
"devDependencies": { "devDependencies": {
"@octokit/openapi": "^21.0.0", "@octokit/openapi": "^19.1.0",
"@sinonjs/fake-timers": "^15.1.0", "@sinonjs/fake-timers": "^14.0.0",
"ava": "^6.4.1", "ava": "^6.4.1",
"c8": "^10.1.3", "c8": "^10.1.3",
"dotenv": "^17.3.1", "dotenv": "^17.2.1",
"esbuild": "^0.27.3", "esbuild": "^0.25.8",
"execa": "^9.6.1", "execa": "^9.6.0",
"open-cli": "^8.0.0", "open-cli": "^8.0.0",
"yaml": "^2.8.2" "undici": "^7.13.0",
"yaml": "^2.8.1"
}, },
"release": { "release": {
"branches": [ "branches": [
@@ -47,7 +46,6 @@
"@semantic-release/release-notes-generator", "@semantic-release/release-notes-generator",
"@semantic-release/github", "@semantic-release/github",
"@semantic-release/npm", "@semantic-release/npm",
"semantic-release-plugin-github-breaking-version-tag",
[ [
"@semantic-release/git", "@semantic-release/git",
{ {

12
post.js
View File

@@ -1,11 +1,17 @@
// @ts-check // @ts-check
import * as core from "@actions/core"; import core from "@actions/core";
import { post } from "./lib/post.js"; import { post } from "./lib/post.js";
import request from "./lib/request.js"; import request, { ensureNativeProxySupport } from "./lib/request.js";
post(core, request).catch((error) => { async function run() {
ensureNativeProxySupport();
return post(core, request);
}
run().catch((error) => {
/* c8 ignore next 3 */ /* c8 ignore next 3 */
console.error(error); console.error(error);
core.setFailed(error.message); core.setFailed(error.message);

View File

@@ -187,14 +187,6 @@
"write" "write"
] ]
}, },
"custom_properties_for_organizations": {
"type": "string",
"description": "The level of permission to grant the access token to view and edit custom properties for an organization, when allowed by the property.",
"enum": [
"read",
"write"
]
},
"members": { "members": {
"type": "string", "type": "string",
"description": "The level of permission to grant the access token for organization teams and members.", "description": "The level of permission to grant the access token for organization teams and members.",
@@ -229,7 +221,7 @@
}, },
"organization_custom_properties": { "organization_custom_properties": {
"type": "string", "type": "string",
"description": "The level of permission to grant the access token for repository custom properties management at the organization level.", "description": "The level of permission to grant the access token for custom property management.",
"enum": [ "enum": [
"read", "read",
"write", "write",
@@ -392,15 +384,6 @@
"read", "read",
"write" "write"
] ]
},
"enterprise_custom_properties_for_organizations": {
"type": "string",
"description": "The level of permission to grant the access token for organization custom properties management at the enterprise level.",
"enum": [
"read",
"write",
"admin"
]
} }
}, },
"example": { "example": {

View File

@@ -21,6 +21,14 @@ for (const file of testFiles) {
const env = { const env = {
GITHUB_OUTPUT: undefined, GITHUB_OUTPUT: undefined,
GITHUB_STATE: undefined, GITHUB_STATE: undefined,
HTTP_PROXY: undefined,
HTTPS_PROXY: undefined,
http_proxy: undefined,
https_proxy: undefined,
NO_PROXY: undefined,
no_proxy: undefined,
NODE_OPTIONS: undefined,
NODE_USE_ENV_PROXY: undefined,
}; };
const { stderr, stdout } = await execa("node", [`tests/${file}`], { env }); const { stderr, stdout } = await execa("node", [`tests/${file}`], { env });
t.snapshot(stderr, "stderr"); t.snapshot(stderr, "stderr");

View File

@@ -0,0 +1,14 @@
process.env.GITHUB_REPOSITORY = "actions/create-github-app-token";
process.env.GITHUB_REPOSITORY_OWNER = "actions";
process.env.HTTPS_PROXY = "http://127.0.0.1:3128";
const originalConsoleError = console.error;
console.error = (...args) => {
originalConsoleError(
...args.map((arg) => (arg instanceof Error ? arg.message : arg)),
);
};
await import("../main.js");
await new Promise((resolve) => setImmediate(resolve));
process.exitCode = 0;

View File

@@ -0,0 +1,13 @@
process.env["INPUT_GITHUB-API-URL"] = "https://api.github.com";
process.env.HTTPS_PROXY = "http://127.0.0.1:3128";
const originalConsoleError = console.error;
console.error = (...args) => {
originalConsoleError(
...args.map((arg) => (arg instanceof Error ? arg.message : arg)),
);
};
await import("../post.js");
await new Promise((resolve) => setImmediate(resolve));
process.exitCode = 0;

View File

@@ -82,6 +82,16 @@ Generated by [AVA](https://avajs.dev).
POST /app/installations/123456/access_tokens␊ POST /app/installations/123456/access_tokens␊
{"repositories":["create-github-app-token"]}` {"repositories":["create-github-app-token"]}`
## main-proxy-requires-native-support.test.js
> stderr
'A proxy environment variable is set, but Node.js native proxy support is not enabled. Set NODE_USE_ENV_PROXY=1 for this action step.'
> stdout
'::error::A proxy environment variable is set, but Node.js native proxy support is not enabled. Set NODE_USE_ENV_PROXY=1 for this action step.'
## main-repo-skew.test.js ## main-repo-skew.test.js
> stderr > stderr
@@ -333,6 +343,16 @@ Generated by [AVA](https://avajs.dev).
POST /app/installations/123456/access_tokens␊ POST /app/installations/123456/access_tokens␊
{"repositories":["create-github-app-token"],"permissions":{"issues":"write","pull_requests":"read"}}` {"repositories":["create-github-app-token"],"permissions":{"issues":"write","pull_requests":"read"}}`
## post-proxy-requires-native-support.test.js
> stderr
'A proxy environment variable is set, but Node.js native proxy support is not enabled. Set NODE_USE_ENV_PROXY=1 for this action step.'
> stdout
'::error::A proxy environment variable is set, but Node.js native proxy support is not enabled. Set NODE_USE_ENV_PROXY=1 for this action step.'
## post-revoke-token-fail-response.test.js ## post-revoke-token-fail-response.test.js
> stderr > stderr

Binary file not shown.