feat(updater): Add SSH key support and comprehensive authentication validation #134

vaind · 2025-10-09T10:48:59Z

Summary

Enhances the updater action with comprehensive authentication validation and adds SSH key support as an alternative to token-based authentication.

Closes #128

Problem

The updater action could fail with cryptic "terminal prompts disabled" errors when there are authentication issues. Based on actions/checkout#664, common causes include:

Expired tokens
Tokens without expiration dates
Insufficient scopes
Incorrect secret references
SSH keys accidentally passed as tokens

Additionally, the action didn't support SSH deploy keys after the v3.0 migration from reusable workflow to composite action. In v2, SSH keys could be passed via api-token, but this stopped working in v3.0.

Solution

Authentication Validation (3 separate steps)

Validate authentication inputs: Ensures at least one auth method is provided
Validate API token (if provided):
- Detects SSH keys mistakenly passed as tokens
- Checks for whitespace/malformed tokens (with detailed position info)
- Validates token scopes for classic PATs
- Tests token access to the repository
Validate SSH key (if provided):
- Validates key format and type

SSH Key Support

Added ssh-key input parameter
Made api-token optional when ssh-key is provided
Both can be used together (SSH for git, token for GitHub API)
Restores the SSH deploy key functionality from v2

Error Messages

Provides detailed, actionable error messages for common issues:

"Token contains whitespace at position X of Y characters: newline (LF)"
"Token appears to be an SSH private key"
"Token has no scopes" / "Token missing 'repo' scope"
"Token validation failed" with checklist of things to verify

Changes

Add ssh-key input parameter
Make api-token optional (requires either api-token or ssh-key)
Add comprehensive authentication validation
Pass both token and ssh-key to actions/checkout
Split validation into separate, focused steps

Test Results

✅ Verified working in https://github.com/getsentry/sentry-react-native/actions/runs/18375302113/job/52347744634?pr=5218

Breaking Changes

If you were passing SSH keys via api-token in v3.0: You must now use the ssh-key input instead.

### Before (v3.0 - would fail)
- uses: getsentry/github-workflows/[email protected]
  with:
    api-token: ${{ secrets.SSH_DEPLOY_KEY }}  # SSH key passed as api-token

### After (v3.1+)
- uses: getsentry/github-workflows/[email protected]
  with:
    ssh-key: ${{ secrets.SSH_DEPLOY_KEY }}  # Use ssh-key input
    api-token: ${{ secrets.GITHUB_TOKEN }}  # Optional: for GitHub API

Note: If you're already using tokens correctly (not SSH keys), no changes are needed.

🤖 Generated with Claude Code

Addresses GitHub Actions checkout authentication issues by: - Adding early token validation with clear error messages - Configuring git credentials explicitly to prevent "terminal prompts disabled" errors This helps prevent and diagnose common token issues like: - Expired tokens - Missing expiration dates - Insufficient scopes - Incorrect secret references Related to actions/checkout#664 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

Checks token scopes using x-oauth-scopes header: - Reports scopes for classic PATs - Warns if repo/public_repo scope missing - Provides guidance for fine-grained PATs Based on https://github.com/orgs/community/discussions/25259

…rocess

Shows detailed information when whitespace is detected: - Token length - Position of whitespace character - Type of whitespace (newline, space, tab, etc) This helps quickly identify malformed token secrets.

Detects when an SSH private key is mistakenly passed as api-token. Provides clear error message explaining the difference between SSH keys and GitHub tokens. This catches the error before the generic whitespace check.

Changes: - Add ssh-key input parameter - Make api-token optional when ssh-key is provided - Pass ssh-key to actions/checkout steps - Skip token validation when using SSH key - Skip git credential config when using SSH key - Validate that only one auth method is provided This allows the action to work with deploy keys, matching the functionality of the previous reusable workflow implementation. Refs: https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#push-using-ssh-deploy-keys

SSH key can be used for git operations while token is used for GitHub API calls (gh commands, PR creation, etc). This is a valid and useful configuration.

Changes: - Step 1: Validate authentication inputs (checks at least one is present) - Step 2: Validate API token (runs only if token provided) - Step 3: Validate SSH key (runs only if SSH key provided) Benefits: - Clearer separation of concerns - Easier to read and maintain - Each validation only runs when relevant - SSH key validation now checks format

The actions/checkout action already handles git credential configuration when token or ssh-key is provided. Manual configuration was redundant and could potentially interfere with checkout's credential handling.

- Add feature and fix entries for SSH key support and authentication validation - Add note to v3 breaking changes about SSH key support in v3.1 - Reference issue #128 and PR #134

updater/action.yml

When using only ssh-key (no api-token), GH_TOKEN was set to empty string, causing gh CLI to refuse authentication instead of falling back to the default GITHUB_TOKEN. This broke critical steps that use gh api: - Parse existing PR URL - Get changelog - Update dependency (when filtering by GH release titles) Changed all instances of: GH_TOKEN: ${{ inputs.api-token }} To: GH_TOKEN: ${{ inputs.api-token || github.token }} This ensures gh CLI always has valid authentication. Fixes seer-by-sentry review comment: #134 (comment)

github-actions · 2025-10-09T12:30:02Z

	Messages
📖	Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Generated by 🚫 dangerJS against 54163cb

…#134

…king changes (#5218) * fix(deps): Fix workflow runs breakage after bump to v3 * Temporarily add the current branch for testing * Update React Native * Remove unneeded default strategy * Update Sentry updater action version in workflow * Update Sentry updater action version in workflow * Update Sentry updater action version in workflow * Update Sentry updater action version in workflow * Update update-deps.yml * Update update-deps.yml * Update GitHub Actions updater version and token type * Update update-deps.yml * Test all all update-deps with changes from getsentry/github-workflows#134 * Update updater action to version 3 in workflows * Revert "Temporarily add the current branch for testing" This reverts commit 26e20ad. --------- Co-authored-by: Ivan Dlugos <[email protected]>

vaind and others added 17 commits October 9, 2025 12:46

fix: Escape template expression in error message

70aad9b

fix(updater): Remove token syntax echo from validation error message

06e4c9b

fix: Improve token validation to detect malformed tokens

a3b716f

refactor: Use PowerShell for token validation and git config

71c67c5

feat: Add token scope validation

7b2af37

Checks token scopes using x-oauth-scopes header: - Reports scopes for classic PATs - Warns if repo/public_repo scope missing - Provides guidance for fine-grained PATs Based on https://github.com/orgs/community/discussions/25259

fix: Reintroduce token validity and access checks in the validation p…

bd87297

…rocess

fix(updater): Remove token syntax echo from validation error message

e496fa7

feat: Enhance whitespace detection in token validation

40bfeac

Shows detailed information when whitespace is detected: - Token length - Position of whitespace character - Type of whitespace (newline, space, tab, etc) This helps quickly identify malformed token secrets.

fix: Remove debug output for token preview in error handling

9e13f1c

feat: Add explicit check for SSH keys in token validation

9333c40

Detects when an SSH private key is mistakenly passed as api-token. Provides clear error message explaining the difference between SSH keys and GitHub tokens. This catches the error before the generic whitespace check.

fix: Allow both api-token and ssh-key together

6835015

SSH key can be used for git operations while token is used for GitHub API calls (gh commands, PR creation, etc). This is a valid and useful configuration.

refactor: Remove manual git credential configuration

da1a5fd

The actions/checkout action already handles git credential configuration when token or ssh-key is provided. Manual configuration was redundant and could potentially interfere with checkout's credential handling.

docs: Add changelog entry and update v3 breaking changes

335d3dd

- Add feature and fix entries for SSH key support and authentication validation - Add note to v3 breaking changes about SSH key support in v3.1 - Reference issue #128 and PR #134

docs: Remove commented-out api-token option from changelog

8e9eef8

vaind marked this pull request as ready for review October 9, 2025 11:56

vaind mentioned this pull request Oct 9, 2025

v3 doesn't work with SSH deploy key #128

Closed

seer-by-sentry bot reviewed Oct 9, 2025

View reviewed changes

updater/action.yml Show resolved Hide resolved

vaind added 2 commits October 9, 2025 14:12

fix: Update updater version to use latest stable release

54163cb

vaind changed the title ~~fix(updater): Add token validation and git credential configuration~~ feat(updater): Add SSH key support and comprehensive authentication validation Oct 9, 2025

vaind merged commit 0d0d99a into main Oct 9, 2025
18 checks passed

antonis added a commit to getsentry/sentry-react-native that referenced this pull request Oct 9, 2025

Test all all update-deps with changes from getsentry/github-workflows…

7f25f87

…#134

antonis mentioned this pull request Oct 10, 2025

chore(deps): bump getsentry/github-workflows from 2 to 3 and fix breaking changes getsentry/sentry-react-native#5218

Merged

10 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(updater): Add SSH key support and comprehensive authentication validation #134

feat(updater): Add SSH key support and comprehensive authentication validation #134

Uh oh!

vaind commented Oct 9, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Oct 9, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

feat(updater): Add SSH key support and comprehensive authentication validation #134

feat(updater): Add SSH key support and comprehensive authentication validation #134

Uh oh!

Conversation

vaind commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

Solution

Authentication Validation (3 separate steps)

SSH Key Support

Error Messages

Changes

Test Results

Breaking Changes

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Oct 9, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vaind commented Oct 9, 2025 •

edited

Loading