Skip to content

fix: permission input handling #243

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 11 commits into from
May 2, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions lib/get-permissions-from-inputs.js
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,12 @@
*/
export function getPermissionsFromInputs(env) {
return Object.entries(env).reduce((permissions, [key, value]) => {
if (!key.startsWith("INPUT_PERMISSION_")) return permissions;
if (!key.startsWith("INPUT_PERMISSION-")) return permissions;
if (!value) return permissions;

const permission = key.slice("INPUT_PERMISSION_".length).toLowerCase();
const permission = key.slice("INPUT_PERMISSION-".length).toLowerCase();

// Inherit app permissions if no permissions inputs are set
if (permissions === undefined) {
return { [permission]: value };
}
Expand Down
1 change: 1 addition & 0 deletions lib/main.js
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,7 @@ export async function main(
permissions
),
{
shouldRetry: (error) => error.status >= 500,
onFailedAttempt: (error) => {
core.info(
`Failed to create token for "${parsedRepositoryNames.join(
Expand Down
4 changes: 2 additions & 2 deletions tests/main-token-permissions-set.test.js
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,6 @@ import { test } from "./main.js";

// Verify `main` successfully sets permissions
await test(() => {
process.env.INPUT_PERMISSION_ISSUES = `write`;
process.env.INPUT_PERMISSION_PULL_REQUESTS = `read`;
process.env["INPUT_PERMISSION-ISSUES"] = `write`;
process.env["INPUT_PERMISSION-PULL-REQUESTS"] = `read`;
});
8 changes: 5 additions & 3 deletions tests/main.js
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,8 @@ so0tiQKBgGQXZaxaXhYUcxYHuCkQ3V4Vsj3ezlM92xXlP32SGFm3KgFhYy9kATxw
Cax1ytZzvlrKLQyQFVK1COs2rHt7W4cJ7op7C8zXfsigXCiejnS664oAuX8sQZID
x3WQZRiXlWejSMUAHuMwXrhGlltF3lw83+xAjnqsVp75kGS6OH61
-----END RSA PRIVATE KEY-----`,
// The Actions runner sets all inputs to empty strings if not set.
"INPUT_PERMISSION-ADMINISTRATION": "",
};

export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
Expand All @@ -61,7 +63,7 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
const owner = env.INPUT_OWNER ?? env.GITHUB_REPOSITORY_OWNER;
const currentRepoName = env.GITHUB_REPOSITORY.split("/")[1];
const repo = encodeURIComponent(
(env.INPUT_REPOSITORIES ?? currentRepoName).split(",")[0],
(env.INPUT_REPOSITORIES ?? currentRepoName).split(",")[0]
);

mockPool
Expand All @@ -77,7 +79,7 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
.reply(
200,
{ id: mockInstallationId, app_slug: mockAppSlug },
{ headers: { "content-type": "application/json" } },
{ headers: { "content-type": "application/json" } }
);

// Mock installation access token request
Expand All @@ -98,7 +100,7 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
.reply(
201,
{ token: mockInstallationAccessToken, expires_at: mockExpiresAt },
{ headers: { "content-type": "application/json" } },
{ headers: { "content-type": "application/json" } }
);

// Run the callback
Expand Down
2 changes: 1 addition & 1 deletion tests/snapshots/index.js.md
Original file line number Diff line number Diff line change
Expand Up @@ -331,7 +331,7 @@ Generated by [AVA](https://avajs.dev).
--- REQUESTS ---␊
GET /repos/actions/create-github-app-token/installation␊
POST /app/installations/123456/access_tokens␊
{"repositories":["create-github-app-token"],"permissions":{"issues":"write","pull_requests":"read"}}`
{"repositories":["create-github-app-token"],"permissions":{"issues":"write","pull-requests":"read"}}`

## post-revoke-token-fail-response.test.js

Expand Down
Binary file modified tests/snapshots/index.js.snap
Binary file not shown.