From b3be8474927ba181cb6250b09b30dc6672d965e6 Mon Sep 17 00:00:00 2001 From: Gregor Martynus <39992+gr2m@users.noreply.github.com> Date: Tue, 11 Jun 2024 10:16:50 -0700 Subject: [PATCH 1/5] docs(README): Create a git committer string for an app installation (#142) closes #137 --- README.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/README.md b/README.md index 008ec32..cb88140 100644 --- a/README.md +++ b/README.md @@ -61,6 +61,26 @@ jobs: github_token: ${{ steps.app-token.outputs.token }} ``` +### Create a git committer string for an app installation + +```yaml +on: [pull_request] + +jobs: + auto-format: + runs-on: ubuntu-latest + steps: + - uses: actions/create-github-app-token@v1 + id: app-token + with: + # required + app-id: ${{ vars.APP_ID }} + private-key: ${{ secrets.PRIVATE_KEY }} + - id: committer + run: echo "string=${{steps.app-auth.outputs.app-slug}}[bot] <${{ steps.app-auth.outputs.installation-id }}+${{ steps.app-auth.outputs.app-slug }}[bot]@users.noreply.github.com>" >> "$GITHUB_OUTPUT" + - run: echo "committer string is ${{steps.committer.outputs.string}}" +``` + ### Create a token for all repositories in the current owner's installation ```yaml From 0fd38177ed30e541bb33920ec93084ea48e27968 Mon Sep 17 00:00:00 2001 From: Gregor Martynus <39992+gr2m@users.noreply.github.com> Date: Tue, 11 Jun 2024 20:56:57 -0700 Subject: [PATCH 2/5] docs(README): add note about expiration (#141) addresses https://github.com/actions/create-github-app-token/issues/121#issuecomment-2043214796 Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com> --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index cb88140..57c2021 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,9 @@ In order to use this action, you need to: 2. [Store the App's ID in your repository environment variables](https://docs.github.com/actions/learn-github-actions/variables#defining-configuration-variables-for-multiple-workflows) (example: `APP_ID`) 3. [Store the App's private key in your repository secrets](https://docs.github.com/actions/security-guides/encrypted-secrets?tool=webui#creating-encrypted-secrets-for-a-repository) (example: `PRIVATE_KEY`) +> [!IMPORTANT] +> An installation access token expires after 1 hour. Please [see this comment](https://github.com/actions/create-github-app-token/issues/121#issuecomment-2043214796) for alternative approaches if you have long-running processes. + ### Create a token for the current repository ```yaml From d2eeb384dfb21a3993b0c722d1a5d36a4b747982 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 21 Jun 2024 21:06:17 -0700 Subject: [PATCH 3/5] build(deps-dev): bump braces from 3.0.2 to 3.0.3 (#146) Bumps [braces](https://github.com/micromatch/braces) from 3.0.2 to 3.0.3.
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=braces&package-manager=npm_and_yarn&previous-version=3.0.2&new-version=3.0.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/actions/create-github-app-token/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/package-lock.json b/package-lock.json index b2a25de..00047b9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "create-github-app-token", - "version": "1.10.0", + "version": "1.10.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "create-github-app-token", - "version": "1.10.0", + "version": "1.10.1", "license": "MIT", "dependencies": { "@actions/core": "^1.10.1", @@ -994,12 +994,12 @@ } }, "node_modules/braces": { - "version": "3.0.2", - "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz", - "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==", + "version": "3.0.3", + "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz", + "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==", "dev": true, "dependencies": { - "fill-range": "^7.0.1" + "fill-range": "^7.1.1" }, "engines": { "node": ">=8" @@ -1668,9 +1668,9 @@ "dev": true }, "node_modules/fill-range": { - "version": "7.0.1", - "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz", - "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==", + "version": "7.1.1", + "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz", + "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==", "dev": true, "dependencies": { "to-regex-range": "^5.0.1" From 66a70456860bafc79e37635eea77b8b2a929f6c8 Mon Sep 17 00:00:00 2001 From: Wechuli Date: Wed, 26 Jun 2024 04:10:54 +0300 Subject: [PATCH 4/5] fix: do not revoke token if already expired (#147) Closes #140 The pull request at #95 introduced changes to avoid revoking expired tokens by saving the `expiresAt` value in the state. The change, however, used `core.setOutput` instead of `core.setState` meaning the value is not saved in the state but rather available in the output. ```javascript if (!skipTokenRevoke) { core.saveState("token", authentication.token); core.setOutput("expiresAt", authentication.expiresAt); } ``` This means that when we use the value downstream, it evaluates to an empty string and the following code block is never run: ```javascript const expiresAt = core.getState("expiresAt"); if (expiresAt && tokenExpiresIn(expiresAt) < 0) { core.info("Token expired, skipping token revocation"); return; } ``` This is a tiny PR to correct that typo. --- dist/main.cjs | 2 +- lib/main.js | 2 +- tests/snapshots/index.js.md | 27 +++++++++------------------ tests/snapshots/index.js.snap | Bin 1131 -> 1128 bytes 4 files changed, 11 insertions(+), 20 deletions(-) diff --git a/dist/main.cjs b/dist/main.cjs index a96b5c0..474eaef 100644 --- a/dist/main.cjs +++ b/dist/main.cjs @@ -39753,7 +39753,7 @@ async function main(appId2, privateKey2, owner2, repositories2, core3, createApp core3.setOutput("app-slug", appSlug); if (!skipTokenRevoke2) { core3.saveState("token", authentication.token); - core3.setOutput("expiresAt", authentication.expiresAt); + core3.saveState("expiresAt", authentication.expiresAt); } } async function getTokenFromOwner(request2, auth5, parsedOwner) { diff --git a/lib/main.js b/lib/main.js index d685277..97443c0 100644 --- a/lib/main.js +++ b/lib/main.js @@ -104,7 +104,7 @@ export async function main( // Make token accessible to post function (so we can invalidate it) if (!skipTokenRevoke) { core.saveState("token", authentication.token); - core.setOutput("expiresAt", authentication.expiresAt); + core.saveState("expiresAt", authentication.expiresAt); } } diff --git a/tests/snapshots/index.js.md b/tests/snapshots/index.js.md index 21918c0..c458d39 100644 --- a/tests/snapshots/index.js.md +++ b/tests/snapshots/index.js.md @@ -33,8 +33,7 @@ Generated by [AVA](https://avajs.dev). ␊ ::set-output name=app-slug::github-actions␊ ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊ - ␊ - ::set-output name=expiresAt::2016-07-11T22:14:10Z` + ::save-state name=expiresAt::2016-07-11T22:14:10Z` ## main-missing-app-id.test.js @@ -94,8 +93,7 @@ Generated by [AVA](https://avajs.dev). ␊ ::set-output name=app-slug::github-actions␊ ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊ - ␊ - ::set-output name=expiresAt::2016-07-11T22:14:10Z` + ::save-state name=expiresAt::2016-07-11T22:14:10Z` ## main-token-get-owner-set-repo-set-to-many.test.js @@ -114,8 +112,7 @@ Generated by [AVA](https://avajs.dev). ␊ ::set-output name=app-slug::github-actions␊ ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊ - ␊ - ::set-output name=expiresAt::2016-07-11T22:14:10Z` + ::save-state name=expiresAt::2016-07-11T22:14:10Z` ## main-token-get-owner-set-repo-set-to-one.test.js @@ -134,8 +131,7 @@ Generated by [AVA](https://avajs.dev). ␊ ::set-output name=app-slug::github-actions␊ ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊ - ␊ - ::set-output name=expiresAt::2016-07-11T22:14:10Z` + ::save-state name=expiresAt::2016-07-11T22:14:10Z` ## main-token-get-owner-set-to-org-repo-unset.test.js @@ -154,8 +150,7 @@ Generated by [AVA](https://avajs.dev). ␊ ::set-output name=app-slug::github-actions␊ ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊ - ␊ - ::set-output name=expiresAt::2016-07-11T22:14:10Z` + ::save-state name=expiresAt::2016-07-11T22:14:10Z` ## main-token-get-owner-set-to-user-fail-response.test.js @@ -175,8 +170,7 @@ Generated by [AVA](https://avajs.dev). ␊ ::set-output name=app-slug::github-actions␊ ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊ - ␊ - ::set-output name=expiresAt::2016-07-11T22:14:10Z` + ::save-state name=expiresAt::2016-07-11T22:14:10Z` ## main-token-get-owner-set-to-user-repo-unset.test.js @@ -195,8 +189,7 @@ Generated by [AVA](https://avajs.dev). ␊ ::set-output name=app-slug::github-actions␊ ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊ - ␊ - ::set-output name=expiresAt::2016-07-11T22:14:10Z` + ::save-state name=expiresAt::2016-07-11T22:14:10Z` ## main-token-get-owner-unset-repo-set.test.js @@ -215,8 +208,7 @@ Generated by [AVA](https://avajs.dev). ␊ ::set-output name=app-slug::github-actions␊ ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊ - ␊ - ::set-output name=expiresAt::2016-07-11T22:14:10Z` + ::save-state name=expiresAt::2016-07-11T22:14:10Z` ## main-token-get-owner-unset-repo-unset.test.js @@ -235,8 +227,7 @@ Generated by [AVA](https://avajs.dev). ␊ ::set-output name=app-slug::github-actions␊ ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊ - ␊ - ::set-output name=expiresAt::2016-07-11T22:14:10Z` + ::save-state name=expiresAt::2016-07-11T22:14:10Z` ## post-revoke-token-fail-response.test.js diff --git a/tests/snapshots/index.js.snap b/tests/snapshots/index.js.snap index 53720f3db20c1a6b28f5ab5d2b11dba78c399cea..5a0653706ded1917da4cb52e95edaeab23821f70 100644 GIT binary patch literal 1128 zcmV-u1eg0kRzVdMHI#-iUC)?%G85m zp)w(w3XS5Kfr#3u1|ZuShH3z5)S1V{VkdIc%F(f0=3tU`72{|v%OMw%c4LDoqFK&1s3VgRe8tAV4CePV5sp3?51a*CU|We38< zWj4_=Nz{GPc|0Ck-eipXJ`K4UFxI~?ZLj%$3mWx%^}Twxx#!gnS}m{E-QC&UX|(pi zYwg}`@Xbxe3?Nl8Mllk}LwMIlC?=8Qp9cZAdq((-dG(#f?dH6p$(&3O_Zb^aGM!H{ zln;R#%gOoe zX$ne}VuW~i3#IZV6E%FUB$8dFNCZ|NN z=J8F(<9I(Vuz2KHWHUKkn$25xk}y|I>W(#>R=$3+trAU|Y_LR?_P7YB1`{c1ph#u= z%c*RC6sv5BEAXwuxmE0*eV-&Lt$kBM?r*m^B7_kV?VWt2N{`g)=shYG3B$WF?5aGZzs{#JK4xg2pcn z8b4&+&MXt@^U3o6!!}1q(v7tSiJ8*Y_%yq@MrSqX&}HZpt}8z}@O+ooDle)qcmZQF zCRZtBtDJ|@8kZH}Qi+to>}EWp=9=1_^SX2Y^%i57TuUMQjGb8!lAv9iM3P?JFf#ul z(^^curBlqmVO{R3>A2cTtz@!QlKfi`O<0{+oabyfWvtMiI=|tVdTElM0r*REVm%ki u$=go&*JqaJk{gmmnd|1&DK`bn%lR9QmzPs7Vq8v~_(EQxUlDTjbc2r-M(Oo}ZDLT-I7n22dA&J!uV zdJ=|I(vMzTdwETNDle_QwgwUHK-3j71kSC&!wQ`?dEul&)3nV(^z_SbP}M$H5ff+< z6VW(C7c7cU2M~urGE`$MMig~3nQ=fv;6lmVLJtHOAK3Vag#;RIt*4v~m7jJW9@{8W z1LZ>Hj<9t!iYNLkZOfz&ahtifiN5U>8(OkQpnUIt7EwPM(AszOlC zZck%SsUGPnp%(XxOvSZi$B9HDOVfx!NRah6gQz0prj)(mC^Ntn3p;Rx?H(MR9zM9+ zKH0y2{K?Vj@yWyX@uwf}pP<}Z4Gq)=(Hl^uP+^LycZ~lJs#lYW9H~>~qF69-1lJa3 za?0t|G`{U<9B;@u5)U1TFa6IwNI>>*Isd#vPeCNRBb0H zQ`-J=O4}dhN}E=tj!!)}vy9y{?{$)F@tbnw{&tf}34>H3?v zl6E3kRmCM$MQ=WP`avct?{V?=c?R-+cgXv7sfTK9^j;=O)Ms*a$UaA$>d%Bz5|^rD zs}}8lN{?SikA{ZZ!yISo7?frB`QG8@+lm8(X+{djQHgfx(StoURIe?AD@2x!NOK+{ znNZKy)-L_&VDj`jF%g3#=tnTWOBxxiI;4M`7MBIPADvfblF|r&+-kZsYL1Nta zlwspHhmD`|j^{EIc6_q_|FG3zF$yxyA(pwP&GCVDbH&b**ujg~DP389cIf$`s9&B} zW8^uE(U{z*C_ail58=X` x7|o?}@~#v9%}dL3K?TaA%vAIGl$w(D Date: Wed, 26 Jun 2024 01:11:30 +0000 Subject: [PATCH 5/5] build(release): 1.10.2 [skip ci] ## [1.10.2](https://github.com/actions/create-github-app-token/compare/v1.10.1...v1.10.2) (2024-06-26) ### Bug Fixes * do not revoke token if already expired ([#147](https://github.com/actions/create-github-app-token/issues/147)) ([66a7045](https://github.com/actions/create-github-app-token/commit/66a70456860bafc79e37635eea77b8b2a929f6c8)), closes [#140](https://github.com/actions/create-github-app-token/issues/140) [#95](https://github.com/actions/create-github-app-token/issues/95) --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index ec5dac8..57ac337 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,7 @@ "name": "create-github-app-token", "private": true, "type": "module", - "version": "1.10.1", + "version": "1.10.2", "description": "GitHub Action for creating a GitHub App Installation Access Token", "scripts": { "build": "esbuild main.js post.js --bundle --outdir=dist --out-extension:.js=.cjs --platform=node --target=node20.0.0",