Skip to content

Commit 5a299d1

Browse files
fix: bypass token checks for forks and OIDC (#1404)
* chore(log): dump context * fix: add logic to bypass token for forks * fix: running the same things * fix: more logging * fix: more core info * fix: run the func * fix: cleanup
1 parent dad251d commit 5a299d1

File tree

3 files changed

+57
-25
lines changed

3 files changed

+57
-25
lines changed

dist/index.js

+37-23
Original file line numberDiff line numberDiff line change
@@ -32440,12 +32440,12 @@ var __webpack_exports__ = {};
3244032440
// ESM COMPAT FLAG
3244132441
__nccwpck_require__.r(__webpack_exports__);
3244232442

32443-
// EXTERNAL MODULE: external "fs"
32444-
var external_fs_ = __nccwpck_require__(7147);
32445-
// EXTERNAL MODULE: external "https"
32446-
var external_https_ = __nccwpck_require__(5687);
32447-
// EXTERNAL MODULE: external "path"
32448-
var external_path_ = __nccwpck_require__(1017);
32443+
;// CONCATENATED MODULE: external "node:fs"
32444+
const external_node_fs_namespaceObject = require("node:fs");
32445+
;// CONCATENATED MODULE: external "node:https"
32446+
const external_node_https_namespaceObject = require("node:https");
32447+
;// CONCATENATED MODULE: external "node:path"
32448+
const external_node_path_namespaceObject = require("node:path");
3244932449
// EXTERNAL MODULE: ./node_modules/@actions/exec/lib/exec.js
3245032450
var exec = __nccwpck_require__(1514);
3245132451
// EXTERNAL MODULE: ./node_modules/@actions/core/lib/core.js
@@ -32562,7 +32562,21 @@ const getGitService = () => {
3256232562
}
3256332563
return 'github';
3256432564
};
32565+
const isFork = () => {
32566+
if (`${context.eventName}` !== 'pull_request' ||
32567+
`${context.eventName}` !== 'pull_request_target') {
32568+
return false;
32569+
}
32570+
const baseLabel = context.payload.pull_request.base.label;
32571+
const headLabel = context.payload.pull_request.head.label;
32572+
core.info(`baseRef: ${baseLabel} | headRef: ${headLabel}`);
32573+
return (baseLabel.split(':')[0] !== headLabel.split(':')[0]);
32574+
};
3256532575
const getToken = () => buildExec_awaiter(void 0, void 0, void 0, function* () {
32576+
if (isFork()) {
32577+
core.info('==> Fork detected, tokenless uploading used');
32578+
return Promise.resolve('');
32579+
}
3256632580
let token = core.getInput('token');
3256732581
let url = core.getInput('url');
3256832582
const useOIDC = isTrue(core.getInput('use_oidc'));
@@ -32863,8 +32877,8 @@ const buildUploadExec = () => buildExec_awaiter(void 0, void 0, void 0, function
3286332877
});
3286432878

3286532879

32866-
// EXTERNAL MODULE: external "crypto"
32867-
var external_crypto_ = __nccwpck_require__(6113);
32880+
;// CONCATENATED MODULE: external "node:crypto"
32881+
const external_node_crypto_namespaceObject = require("node:crypto");
3286832882
// EXTERNAL MODULE: ./node_modules/gpg/lib/gpg.js
3286932883
var gpg = __nccwpck_require__(40);
3287032884
// EXTERNAL MODULE: ./node_modules/undici/index.js
@@ -32896,24 +32910,24 @@ const verify = (filename, platform, version, verbose, failCi) => validate_awaite
3289632910
if (verbose) {
3289732911
console.log(`Received SHA256SUM ${shasum}`);
3289832912
}
32899-
yield external_fs_.writeFileSync(external_path_.join(__dirname, `${uploaderName}.SHA256SUM`), shasum);
32913+
yield external_node_fs_namespaceObject.writeFileSync(external_node_path_namespaceObject.join(__dirname, `${uploaderName}.SHA256SUM`), shasum);
3290032914
const shaSigRes = yield (0,undici.request)(`${getBaseUrl(platform, version)}.SHA256SUM.sig`);
3290132915
const shaSig = yield shaSigRes.body.text();
3290232916
if (verbose) {
3290332917
console.log(`Received SHA256SUM signature ${shaSig}`);
3290432918
}
32905-
yield external_fs_.writeFileSync(external_path_.join(__dirname, `${uploaderName}.SHA256SUM.sig`), shaSig);
32919+
yield external_node_fs_namespaceObject.writeFileSync(external_node_path_namespaceObject.join(__dirname, `${uploaderName}.SHA256SUM.sig`), shaSig);
3290632920
const validateSha = () => validate_awaiter(void 0, void 0, void 0, function* () {
3290732921
const calculateHash = (filename) => validate_awaiter(void 0, void 0, void 0, function* () {
32908-
const stream = external_fs_.createReadStream(filename);
32909-
const uploaderSha = external_crypto_.createHash(`sha256`);
32922+
const stream = external_node_fs_namespaceObject.createReadStream(filename);
32923+
const uploaderSha = external_node_crypto_namespaceObject.createHash(`sha256`);
3291032924
stream.pipe(uploaderSha);
3291132925
return new Promise((resolve, reject) => {
3291232926
stream.on('end', () => resolve(`${uploaderSha.digest('hex')} ${uploaderName}`));
3291332927
stream.on('error', reject);
3291432928
});
3291532929
});
32916-
const hash = yield calculateHash(external_path_.join(__dirname, `${uploaderName}`));
32930+
const hash = yield calculateHash(external_node_path_namespaceObject.join(__dirname, `${uploaderName}`));
3291732931
if (hash === shasum) {
3291832932
core.info(`==> Uploader SHASUM verified (${hash})`);
3291932933
}
@@ -32927,11 +32941,11 @@ const verify = (filename, platform, version, verbose, failCi) => validate_awaite
3292732941
'--logger-fd',
3292832942
'1',
3292932943
'--verify',
32930-
external_path_.join(__dirname, `${uploaderName}.SHA256SUM.sig`),
32931-
external_path_.join(__dirname, `${uploaderName}.SHA256SUM`),
32944+
external_node_path_namespaceObject.join(__dirname, `${uploaderName}.SHA256SUM.sig`),
32945+
external_node_path_namespaceObject.join(__dirname, `${uploaderName}.SHA256SUM`),
3293232946
], (err, verifyResult) => validate_awaiter(void 0, void 0, void 0, function* () {
3293332947
if (err) {
32934-
setFailure('Codecov: Error importing pgp key', failCi);
32948+
setFailure(`Codecov: Error importing pgp key: ${err.message}`, failCi);
3293532949
}
3293632950
core.info(verifyResult);
3293732951
yield validateSha();
@@ -32943,10 +32957,10 @@ const verify = (filename, platform, version, verbose, failCi) => validate_awaite
3294332957
'1',
3294432958
'--no-default-keyring',
3294532959
'--import',
32946-
__nccwpck_require__.ab + "pgp_keys.asc",
32960+
external_node_path_namespaceObject.join(__dirname, 'pgp_keys.asc'),
3294732961
], (err, importResult) => validate_awaiter(void 0, void 0, void 0, function* () {
3294832962
if (err) {
32949-
setFailure('Codecov: Error importing pgp key', failCi);
32963+
setFailure(`Codecov: Error importing pgp key: ${err.message}`, failCi);
3295032964
}
3295132965
core.info(importResult);
3295232966
verifySignature();
@@ -33011,10 +33025,10 @@ const run = () => src_awaiter(void 0, void 0, void 0, function* () {
3301133025
const { uploadExecArgs, uploadOptions, disableSafeDirectory, failCi, os, uploaderVersion, uploadCommand, } = yield buildUploadExec();
3301233026
const { args, verbose } = buildGeneralExec();
3301333027
const platform = getPlatform(os);
33014-
const filename = external_path_.join(__dirname, getUploaderName(platform));
33015-
external_https_.get(getBaseUrl(platform, uploaderVersion), (res) => {
33028+
const filename = external_node_path_namespaceObject.join(__dirname, getUploaderName(platform));
33029+
external_node_https_namespaceObject.get(getBaseUrl(platform, uploaderVersion), (res) => {
3301633030
// Image will be stored at this path
33017-
const filePath = external_fs_.createWriteStream(filename);
33031+
const filePath = external_node_fs_namespaceObject.createWriteStream(filename);
3301833032
res.pipe(filePath);
3301933033
filePath
3302033034
.on('error', (err) => {
@@ -33023,12 +33037,12 @@ const run = () => src_awaiter(void 0, void 0, void 0, function* () {
3302333037
filePath.close();
3302433038
yield validate(filename, platform, uploaderVersion, verbose, failCi);
3302533039
yield version(platform, uploaderVersion);
33026-
yield external_fs_.chmodSync(filename, '777');
33040+
yield external_node_fs_namespaceObject.chmodSync(filename, '777');
3302733041
if (!disableSafeDirectory) {
3302833042
yield setSafeDirectory();
3302933043
}
3303033044
const unlink = () => {
33031-
external_fs_.unlink(filename, (err) => {
33045+
external_node_fs_namespaceObject.unlink(filename, (err) => {
3303233046
if (err) {
3303333047
setFailure(`Codecov: Could not unlink uploader: ${err.message}`, failCi);
3303433048
}

dist/index.js.map

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

src/buildExec.ts

+19-1
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,29 @@ const getGitService = (): string => {
2929
return 'github';
3030
};
3131

32+
const isFork = (): boolean => {
33+
if (
34+
`${context.eventName}` !== 'pull_request' ||
35+
`${context.eventName}` !== 'pull_request_target'
36+
) {
37+
return false;
38+
}
39+
40+
const baseLabel = context.payload.pull_request.base.label;
41+
const headLabel = context.payload.pull_request.head.label;
42+
43+
core.info(`baseRef: ${baseLabel} | headRef: ${headLabel}`);
44+
return (baseLabel.split(':')[0] !== headLabel.split(':')[0]);
45+
};
46+
3247
const getToken = async (): Promise<string> => {
48+
if (isFork()) {
49+
core.info('==> Fork detected, tokenless uploading used');
50+
return Promise.resolve('');
51+
}
3352
let token = core.getInput('token');
3453
let url = core.getInput('url');
3554
const useOIDC = isTrue(core.getInput('use_oidc'));
36-
3755
if (useOIDC) {
3856
if (!url) {
3957
url = 'https://codecov.io';

0 commit comments

Comments
 (0)