c3c17c79cc
This PR switches from evaluating values passed to `skip-token-revoke` as
true if they are truthy in JavaScript, to using `getBooleanInput`. This
change ensures that only proper YAML boolean values are recognized,
preventing unintended evaluations to true.
- The definition of `getBooleanInput` is here: definition of
`core#getBooealnInput` is here:
930c890727/packages/core/src/core.ts (L188-L208)
The documentation states, `"If truthy, the token will not be revoked
when the current job is complete"`, so this change could be considered a
breaking change. This means that if there are users who rely on `truthy`
and expect values like whitespace or `"false"` to be evaluated as true
(though this is likely rare), it would be a breaking change.
- `Boolean(" ")` and `Boolean("false")` are both evaluated as true.
Alternatively, it can simply be considered a fix. How to handle this is
up to the maintainer.
Resolves https://github.com/actions/create-github-app-token/issues/216
34 lines
1.1 KiB
JavaScript
34 lines
1.1 KiB
JavaScript
import { MockAgent, setGlobalDispatcher } from "undici";
|
|
|
|
// state variables are set as environment variables with the prefix STATE_
|
|
// https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#sending-values-to-the-pre-and-post-actions
|
|
process.env.STATE_token = "secret123";
|
|
|
|
// inputs are set as environment variables with the prefix INPUT_
|
|
// https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#example-specifying-inputs
|
|
process.env["INPUT_GITHUB-API-URL"] = "https://api.github.com";
|
|
process.env["INPUT_SKIP-TOKEN-REVOKE"] = "false";
|
|
|
|
// 1 hour in the future, not expired
|
|
process.env.STATE_expiresAt = new Date(Date.now() + 1000 * 60 * 60).toISOString();
|
|
|
|
const mockAgent = new MockAgent();
|
|
|
|
setGlobalDispatcher(mockAgent);
|
|
|
|
// Provide the base url to the request
|
|
const mockPool = mockAgent.get("https://api.github.com");
|
|
|
|
// intercept the request
|
|
mockPool
|
|
.intercept({
|
|
path: "/installation/token",
|
|
method: "DELETE",
|
|
headers: {
|
|
authorization: "token secret123",
|
|
},
|
|
})
|
|
.reply(204);
|
|
|
|
await import("../post.js");
|