Skip to content
Merged
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
.env
coverage
node_modules/
.vscode
5 changes: 5 additions & 0 deletions .vscode/settings.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
{
"cSpell.words": [
"lepadatu"
]
}
9 changes: 7 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,13 @@ In the vanilla action, the runner has direct access to sensitive information (i.

This action mitigates this risk by importing the sensitive information in a very secure location (AWS KMS) which does not allow the retrieval of the sensitive information.

>[!IMPORTANT]
>Neither this action, nor AWS is responsible for securing access to your AWS account. See the [shared responsibility model](https://docs.aws.amazon.com/whitepapers/latest/aws-risk-and-compliance/shared-responsibility-model.html). It is highly advised to use temporary AWS credentials scoped to the least privilege when accessing AWS API in order to sign the JWT token.
>[!IMPORTANT]
>
>Neither this action, nor AWS is responsible for securing access to your AWS account. See the [shared responsibility model](https://docs.aws.amazon.com/whitepapers/latest/aws-risk-and-compliance/shared-responsibility-model.html).
>
>It is highly advised to use temporary AWS credentials scoped to the least privilege when accessing AWS API in order to sign the JWT token.
>
>Using AWS KMS will generate extra costs in your AWS bill.


## Usage
Expand Down
90 changes: 1 addition & 89 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 7 additions & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -50,5 +50,11 @@
}
]
]
}
},
"main": "main.js",
"directories": {
"lib": "lib",
"test": "tests"
},
"author": ""
}
4 changes: 2 additions & 2 deletions tests/main-missing-kms-key-id.test.js
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
process.env.GITHUB_REPOSITORY_OWNER = "lepadatu-org";
process.env.GITHUB_REPOSITORY = "lepadatu-org/create-github-app-token-aws";
process.env.GITHUB_REPOSITORY_OWNER = "lepadatu-actions";
process.env.GITHUB_REPOSITORY = "lepadatu-actions/create-github-app-token-aws";
process.env["INPUT_APP-ID"] = "123456";

// Verify `main` exits with an error when neither the `kms-key-id` nor `kms_key_id` input is set.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ await test((mockPool) => {
method: "POST",
headers: {
accept: "application/vnd.github.v3+json",
"user-agent": "lepadatu-org/create-github-app-token-aws",
"user-agent": "lepadatu-actions/create-github-app-token-aws",
// Intentionally omitting the `authorization` header.
},
})
Expand Down
4 changes: 2 additions & 2 deletions tests/main.js
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@
import { MockAgent, setGlobalDispatcher } from "undici";

export const DEFAULT_ENV = {
GITHUB_REPOSITORY_OWNER: "lepadatu-org",
GITHUB_REPOSITORY: "lepadatu-org/create-github-app-token-aws",
GITHUB_REPOSITORY_OWNER: "lepadatu-actions",
GITHUB_REPOSITORY: "lepadatu-actions/create-github-app-token-aws",
// inputs are set as environment variables with the prefix INPUT_
// https://docs.github.com/actions/creating-actions/metadata-syntax-for-github-actions#example-specifying-inputs
"INPUT_GITHUB-API-URL": "https://api.github.com",
Expand Down
12 changes: 6 additions & 6 deletions tests/snapshots/index.js.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ Generated by [AVA](https://avajs.dev).

> stdout

`owner and repositories set, creating token for repositories "lepadatu-org/create-github-app-token-aws" owned by "lepadatu-org"␊
`owner and repositories set, creating token for repositories "lepadatu-actions/create-github-app-token-aws" owned by "lepadatu-actions"␊
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
Expand Down Expand Up @@ -93,7 +93,7 @@ Generated by [AVA](https://avajs.dev).

> stdout

`owner and repositories set, creating token for repositories "lepadatu-org/create-github-app-token-aws" owned by "lepadatu-org"␊
`owner and repositories set, creating token for repositories "lepadatu-actions/create-github-app-token-aws" owned by "lepadatu-actions"␊
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
Expand Down Expand Up @@ -132,7 +132,7 @@ Generated by [AVA](https://avajs.dev).

> stdout

`owner and repositories set, creating token for repositories "lepadatu-org/create-github-app-token-aws,actions/toolkit" owned by "lepadatu-org"␊
`owner and repositories set, creating token for repositories "lepadatu-actions/create-github-app-token-aws,actions/toolkit" owned by "lepadatu-actions"␊
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
Expand All @@ -151,7 +151,7 @@ Generated by [AVA](https://avajs.dev).

> stdout

`owner and repositories set, creating token for repositories "lepadatu-org/create-github-app-token-aws" owned by "lepadatu-org"␊
`owner and repositories set, creating token for repositories "lepadatu-actions/create-github-app-token-aws" owned by "lepadatu-actions"␊
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
Expand All @@ -170,7 +170,7 @@ Generated by [AVA](https://avajs.dev).

> stdout

`repositories not set, creating token for all repositories for given owner "lepadatu-org"␊
`repositories not set, creating token for all repositories for given owner "lepadatu-actions"␊
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
Expand Down Expand Up @@ -228,7 +228,7 @@ Generated by [AVA](https://avajs.dev).

> stdout

`owner not set, creating owner for given repositories "lepadatu-org/create-github-app-token-aws" in current owner ("lepadatu-org")␊
`owner not set, creating owner for given repositories "lepadatu-actions/create-github-app-token-aws" in current owner ("lepadatu-actions")␊
::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
Expand Down
Binary file modified tests/snapshots/index.js.snap
Binary file not shown.