Skip to content

Commit 4a152e2

Browse files
qoomonqoomon
committed
Update action.yaml
1 parent 24ec4d4 commit 4a152e2

File tree

10 files changed

+309
-343
lines changed

10 files changed

+309
-343
lines changed

‎.github/workflows/action-regression-test.yml

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,13 @@ concurrency:
1919
group: ${{ github.workflow }}-${{ github.ref }}
2020

2121
jobs:
22-
build:
22+
main:
2323
runs-on: ubuntu-latest
2424
permissions:
2525
contents: read
2626
id-token: write
2727
steps:
28-
- uses: actions/checkout@v4
29-
- uses: ./
28+
- uses: qoomon/actions--access-token@main
3029
id: access-token
3130
with:
3231
permissions: |

‎action/action.yaml

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,11 @@
1-
name: Access Tokens for GitHub Actions
1+
name: Ephemeral Access Tokens for GitHub Actions
22
description: GitHub Action to request temporary access tokens
33
author: qoomon
44
branding:
55
icon: unlock
66
color: blue
77

88
inputs:
9-
scope:
10-
default: repos
11-
description: |
12-
Token scope either 'repos' or 'owner'
13-
If you want to request owner wide permissions, you need to set the scope to 'owner'
149
permissions:
1510
description: |
1611
Permissions to request as YAML object string, e.g.
@@ -24,7 +19,7 @@ inputs:
2419
Defaults to OIDC token repository, only if inputs.owner is equal to OIDC token repository owner
2520
repositories:
2621
description: |
27-
Target repositories as YAML array string, e.g.
22+
Target repositories as YAML array string or 'ALL', e.g.
2823
repositories: |
2924
- playground
3025
- shop

‎action/dist/main/index.js

Lines changed: 37 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -62782,13 +62782,13 @@ function handleSetResult(result, final) {
6278262782
}
6278362783
final.value.add(result.value);
6278462784
}
62785-
const $ZodEnum = /*@__PURE__*/ $constructor("$ZodEnum", (inst, def) => {
62785+
const $ZodEnum = /*@__PURE__*/ (/* unused pure expression or super */ null && (core.$constructor("$ZodEnum", (inst, def) => {
6278662786
$ZodType.init(inst, def);
62787-
const values = getEnumValues(def.entries);
62787+
const values = util.getEnumValues(def.entries);
6278862788
inst._zod.values = new Set(values);
6278962789
inst._zod.pattern = new RegExp(`^(${values
62790-
.filter((k) => propertyKeyTypes.has(typeof k))
62791-
.map((o) => (typeof o === "string" ? escapeRegex(o) : o.toString()))
62790+
.filter((k) => util.propertyKeyTypes.has(typeof k))
62791+
.map((o) => (typeof o === "string" ? util.escapeRegex(o) : o.toString()))
6279262792
.join("|")})$`);
6279362793
inst._zod.parse = (payload, _ctx) => {
6279462794
const input = payload.value;
@@ -62803,12 +62803,12 @@ const $ZodEnum = /*@__PURE__*/ $constructor("$ZodEnum", (inst, def) => {
6280362803
});
6280462804
return payload;
6280562805
};
62806-
});
62807-
const $ZodLiteral = /*@__PURE__*/ (/* unused pure expression or super */ null && (core.$constructor("$ZodLiteral", (inst, def) => {
62806+
})));
62807+
const $ZodLiteral = /*@__PURE__*/ $constructor("$ZodLiteral", (inst, def) => {
6280862808
$ZodType.init(inst, def);
6280962809
inst._zod.values = new Set(def.values);
6281062810
inst._zod.pattern = new RegExp(`^(${def.values
62811-
.map((o) => (typeof o === "string" ? util.escapeRegex(o) : o ? o.toString() : String(o)))
62811+
.map((o) => (typeof o === "string" ? escapeRegex(o) : o ? o.toString() : String(o)))
6281262812
.join("|")})$`);
6281362813
inst._zod.parse = (payload, _ctx) => {
6281462814
const input = payload.value;
@@ -62823,7 +62823,7 @@ const $ZodLiteral = /*@__PURE__*/ (/* unused pure expression or super */ null &&
6282362823
});
6282462824
return payload;
6282562825
};
62826-
})));
62826+
});
6282762827
const $ZodFile = /*@__PURE__*/ (/* unused pure expression or super */ null && (core.$constructor("$ZodFile", (inst, def) => {
6282862828
$ZodType.init(inst, def);
6282962829
inst._zod.parse = (payload, _ctx) => {
@@ -64847,8 +64847,8 @@ function set(valueType, params) {
6484764847
...util.normalizeParams(params),
6484864848
});
6484964849
}
64850-
const ZodEnum = /*@__PURE__*/ $constructor("ZodEnum", (inst, def) => {
64851-
$ZodEnum.init(inst, def);
64850+
const ZodEnum = /*@__PURE__*/ (/* unused pure expression or super */ null && (core.$constructor("ZodEnum", (inst, def) => {
64851+
core.$ZodEnum.init(inst, def);
6485264852
ZodType.init(inst, def);
6485364853
inst.enum = def.entries;
6485464854
inst.options = Object.values(def.entries);
@@ -64865,7 +64865,7 @@ const ZodEnum = /*@__PURE__*/ $constructor("ZodEnum", (inst, def) => {
6486564865
return new ZodEnum({
6486664866
...def,
6486764867
checks: [],
64868-
...normalizeParams(params),
64868+
...util.normalizeParams(params),
6486964869
entries: newEntries,
6487064870
});
6487164871
};
@@ -64881,17 +64881,17 @@ const ZodEnum = /*@__PURE__*/ $constructor("ZodEnum", (inst, def) => {
6488164881
return new ZodEnum({
6488264882
...def,
6488364883
checks: [],
64884-
...normalizeParams(params),
64884+
...util.normalizeParams(params),
6488564885
entries: newEntries,
6488664886
});
6488764887
};
64888-
});
64888+
})));
6488964889
function schemas_enum(values, params) {
6489064890
const entries = Array.isArray(values) ? Object.fromEntries(values.map((v) => [v, v])) : values;
6489164891
return new ZodEnum({
6489264892
type: "enum",
6489364893
entries,
64894-
...normalizeParams(params),
64894+
...util.normalizeParams(params),
6489564895
});
6489664896
}
6489764897

@@ -64909,8 +64909,8 @@ function nativeEnum(entries, params) {
6490964909
...util.normalizeParams(params),
6491064910
});
6491164911
}
64912-
const ZodLiteral = /*@__PURE__*/ (/* unused pure expression or super */ null && (core.$constructor("ZodLiteral", (inst, def) => {
64913-
core.$ZodLiteral.init(inst, def);
64912+
const ZodLiteral = /*@__PURE__*/ $constructor("ZodLiteral", (inst, def) => {
64913+
$ZodLiteral.init(inst, def);
6491464914
ZodType.init(inst, def);
6491564915
inst.values = new Set(def.values);
6491664916
Object.defineProperty(inst, "value", {
@@ -64921,12 +64921,12 @@ const ZodLiteral = /*@__PURE__*/ (/* unused pure expression or super */ null &&
6492164921
return def.values[0];
6492264922
},
6492364923
});
64924-
})));
64924+
});
6492564925
function literal(value, params) {
6492664926
return new ZodLiteral({
6492764927
type: "literal",
6492864928
values: Array.isArray(value) ? value : [value],
64929-
...util.normalizeParams(params),
64929+
...normalizeParams(params),
6493064930
});
6493164931
}
6493264932
const ZodFile = /*@__PURE__*/ (/* unused pure expression or super */ null && (core.$constructor("ZodFile", (inst, def) => {
@@ -65318,23 +65318,35 @@ if (appServerInput) {
6531865318
// --- Main ------------------------------------------------------------------------------------------------------------
6531965319
runAction(async () => {
6532065320
const input = {
65321-
scope: schemas_enum(['repos', 'owner'])
65322-
.parse(getInput('scope')),
6532365321
permissions: record(schemas_string(), schemas_string())
6532465322
.parse(getYamlInput('permissions', { required: true })),
6532565323
repository: getInput('repository'),
65326-
repositories: array(schemas_string()).default([])
65324+
repositories: union([
65325+
array(schemas_string()),
65326+
literal('ALL'),
65327+
])
65328+
.default(() => [])
6532765329
.parse(getYamlInput('repositories')),
6532865330
owner: getInput('owner'),
65331+
// --- legacy support
65332+
scope: getInput('scope'),
6532965333
};
65330-
// Legacy support for snake_case permissions
65331-
input.permissions = mapObjectEntries(input.permissions, ([key, value]) => [key.replace('_', '-'), value]);
65332-
if (input.repository) {
65334+
// --- legacy support
65335+
{
65336+
// legacy support for owner input
65337+
if (input.scope === 'owner') {
65338+
if (Array.isArray(input.repositories) && input.repositories.length === 0) {
65339+
input.repositories = 'ALL';
65340+
}
65341+
}
65342+
// Legacy support for snake_case permissions
65343+
input.permissions = mapObjectEntries(input.permissions, ([key, value]) => [key.replace('_', '-'), value]);
65344+
}
65345+
if (Array.isArray(input.repositories) && input.repository) {
6533365346
input.repositories.unshift(input.repository);
6533465347
}
6533565348
lib_core.info('Get access token...');
6533665349
const accessToken = await getAccessToken({
65337-
scope: input.scope,
6533865350
permissions: input.permissions,
6533965351
repositories: input.repositories,
6534065352
owner: input.owner,

‎action/src/action-main.ts

Lines changed: 22 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,27 +14,40 @@ import {OutgoingHttpHeaders} from 'http';
1414

1515
runAction(async () => {
1616
const input = {
17-
scope: z.enum(['repos', 'owner'])
18-
.parse(getInput('scope')),
1917
permissions: z.record(z.string(), z.string())
2018
.parse(getYamlInput('permissions', {required: true})),
2119
repository: getInput('repository'),
22-
repositories: z.array(z.string()).default([])
20+
repositories: z.union([
21+
z.array(z.string()),
22+
z.literal('ALL'),
23+
])
24+
.default(() => [])
2325
.parse(getYamlInput('repositories')),
2426
owner: getInput('owner'),
27+
// --- legacy support
28+
scope: getInput('scope'),
2529
};
2630

27-
// Legacy support for snake_case permissions
28-
input.permissions = mapObjectEntries(input.permissions,
29-
([key, value]) => [key.replace('_', '-'), value]);
31+
// --- legacy support
32+
{
33+
// legacy support for owner input
34+
if (input.scope === 'owner') {
35+
if (Array.isArray(input.repositories) && input.repositories.length === 0) {
36+
input.repositories = 'ALL';
37+
}
38+
}
39+
40+
// Legacy support for snake_case permissions
41+
input.permissions = mapObjectEntries(input.permissions,
42+
([key, value]) => [key.replace('_', '-'), value]);
43+
}
3044

31-
if (input.repository) {
45+
if (Array.isArray(input.repositories) && input.repository) {
3246
input.repositories.unshift(input.repository);
3347
}
3448

3549
core.info('Get access token...');
3650
const accessToken = await getAccessToken({
37-
scope: input.scope,
3851
permissions: input.permissions,
3952
repositories: input.repositories,
4053
owner: input.owner,
@@ -59,9 +72,8 @@ runAction(async () => {
5972
* @return token
6073
*/
6174
async function getAccessToken(tokenRequest: {
62-
scope: 'repos' | 'owner' | undefined
6375
permissions: GitHubAppPermissions
64-
repositories: string[] | undefined
76+
repositories: string[] | 'ALL' | undefined
6577
owner: string | undefined
6678
}): Promise<GitHubAccessTokenResponse> {
6779
const idTokenForAccessManager = await core.getIDToken(config.appServer.url.hostname)

‎server/playground.ts

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
import {z} from 'zod';
2+
const GitHubRepositoryOwnerRegex = /^[a-z\d](-?[a-z\d])+$/i;
3+
export const GitHubRepositoryOwnerSchema = z.string().regex(GitHubRepositoryOwnerRegex);
4+
const GitHubRepositoryNameRegex = /^[a-z\d-._]+$/i;
5+
export const GitHubRepositoryNameSchema = z.string().regex(GitHubRepositoryNameRegex);
6+
7+
export const GitHubRepositorySchema = z.string().regex(
8+
new RegExp(`^${GitHubRepositoryOwnerRegex.source.replace(/^\^|\$$/g, '')}` +
9+
`/${GitHubRepositoryNameRegex.source.replace(/^\^|\$$/g, '')}$`, 'i'),
10+
);
11+
const schema = z.strictObject({
12+
permissions: z.any(),
13+
repositories: z.union([
14+
z.array(z.union([GitHubRepositoryNameSchema, GitHubRepositorySchema])),
15+
z.literal('ALL'),
16+
], {
17+
error: `Invalid repository: Must be a valid repository name, match <owner>/<repository> or 'ALL'`
18+
},
19+
).default([]),
20+
});
21+

0 commit comments

Comments
 (0)