Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dev #7

Merged
merged 16 commits into from
Sep 4, 2024
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
.env
coverage
node_modules/
.vscode
5 changes: 5 additions & 0 deletions .vscode/settings.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
{
"cSpell.words": [
"lepadatu"
]
}
9 changes: 7 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,13 @@ In the vanilla action, the runner has direct access to sensitive information (i.

This action mitigates this risk by importing the sensitive information in a very secure location (AWS KMS) which does not allow the retrieval of the sensitive information.

>[!IMPORTANT]
>Neither this action, nor AWS is responsible for securing access to your AWS account. See the [shared responsibility model](https://docs.aws.amazon.com/whitepapers/latest/aws-risk-and-compliance/shared-responsibility-model.html). It is highly advised to use temporary AWS credentials scoped to the least privilege when accessing AWS API in order to sign the JWT token.
>[!IMPORTANT]
>
>Neither this action, nor AWS is responsible for securing access to your AWS account. See the [shared responsibility model](https://docs.aws.amazon.com/whitepapers/latest/aws-risk-and-compliance/shared-responsibility-model.html).
>
>It is highly advised to use temporary AWS credentials scoped to the least privilege when accessing AWS API in order to sign the JWT token.
>
>Using AWS KMS will generate extra costs in your AWS bill.


## Usage
Expand Down
90 changes: 1 addition & 89 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 7 additions & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -50,5 +50,11 @@
}
]
]
}
},
"main": "main.js",
"directories": {
"lib": "lib",
"test": "tests"
},
"author": ""
}
4 changes: 2 additions & 2 deletions tests/main-missing-kms-key-id.test.js
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
process.env.GITHUB_REPOSITORY_OWNER = "lepadatu-org";
process.env.GITHUB_REPOSITORY = "lepadatu-org/create-github-app-token-aws";
process.env.GITHUB_REPOSITORY_OWNER = "lepadatu-actions";
process.env.GITHUB_REPOSITORY = "lepadatu-actions/create-github-app-token-aws";
process.env["INPUT_APP-ID"] = "123456";

// Verify `main` exits with an error when neither the `kms-key-id` nor `kms_key_id` input is set.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ await test((mockPool) => {
method: "POST",
headers: {
accept: "application/vnd.github.v3+json",
"user-agent": "lepadatu-org/create-github-app-token-aws",
"user-agent": "lepadatu-actions/create-github-app-token-aws",
// Intentionally omitting the `authorization` header.
},
})
Expand Down
4 changes: 2 additions & 2 deletions tests/main.js
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@
import { MockAgent, setGlobalDispatcher } from "undici";

export const DEFAULT_ENV = {
GITHUB_REPOSITORY_OWNER: "lepadatu-org",
GITHUB_REPOSITORY: "lepadatu-org/create-github-app-token-aws",
GITHUB_REPOSITORY_OWNER: "lepadatu-actions",
GITHUB_REPOSITORY: "lepadatu-actions/create-github-app-token-aws",
// inputs are set as environment variables with the prefix INPUT_
// https://docs.github.com/actions/creating-actions/metadata-syntax-for-github-actions#example-specifying-inputs
"INPUT_GITHUB-API-URL": "https://api.github.com",
Expand Down
12 changes: 6 additions & 6 deletions tests/snapshots/index.js.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ Generated by [AVA](https://avajs.dev).

> stdout

`owner and repositories set, creating token for repositories "lepadatu-org/create-github-app-token-aws" owned by "lepadatu-org"␊
`owner and repositories set, creating token for repositories "lepadatu-actions/create-github-app-token-aws" owned by "lepadatu-actions"␊
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
Expand Down Expand Up @@ -93,7 +93,7 @@ Generated by [AVA](https://avajs.dev).

> stdout

`owner and repositories set, creating token for repositories "lepadatu-org/create-github-app-token-aws" owned by "lepadatu-org"␊
`owner and repositories set, creating token for repositories "lepadatu-actions/create-github-app-token-aws" owned by "lepadatu-actions"␊
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
Expand Down Expand Up @@ -132,7 +132,7 @@ Generated by [AVA](https://avajs.dev).

> stdout

`owner and repositories set, creating token for repositories "lepadatu-org/create-github-app-token-aws,actions/toolkit" owned by "lepadatu-org"␊
`owner and repositories set, creating token for repositories "lepadatu-actions/create-github-app-token-aws,actions/toolkit" owned by "lepadatu-actions"␊
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
Expand All @@ -151,7 +151,7 @@ Generated by [AVA](https://avajs.dev).

> stdout

`owner and repositories set, creating token for repositories "lepadatu-org/create-github-app-token-aws" owned by "lepadatu-org"␊
`owner and repositories set, creating token for repositories "lepadatu-actions/create-github-app-token-aws" owned by "lepadatu-actions"␊
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
Expand All @@ -170,7 +170,7 @@ Generated by [AVA](https://avajs.dev).

> stdout

`repositories not set, creating token for all repositories for given owner "lepadatu-org"␊
`repositories not set, creating token for all repositories for given owner "lepadatu-actions"␊
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
Expand Down Expand Up @@ -228,7 +228,7 @@ Generated by [AVA](https://avajs.dev).

> stdout

`owner not set, creating owner for given repositories "lepadatu-org/create-github-app-token-aws" in current owner ("lepadatu-org")␊
`owner not set, creating owner for given repositories "lepadatu-actions/create-github-app-token-aws" in current owner ("lepadatu-actions")␊
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
Expand Down
Binary file modified tests/snapshots/index.js.snap
Binary file not shown.