Skip to content

Commit 58070c2

Browse files
sebastianrathsebastianrath
authored
Merge pull request #20 from actionforge/bugfix/token
Fix and secure GITHUB_TOKEN
2 parents dde7018 + 4f7519a commit 58070c2

21 files changed

Lines changed: 245 additions & 215 deletions

‎core/graph.go‎

Lines changed: 35 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -277,6 +277,30 @@ func RunGraph(ctx context.Context, graphName string, graphContent []byte, opts R
277277
return CreateErr(nil, err, "failed to load yaml")
278278
}
279279

280+
// Capture GITHUB_TOKEN / INPUT_GITHUB_TOKEN from the OS environment and store in
281+
// OverrideSecrets so it remains available for repo cloning (gh-action) and
282+
// is properly surfaced as secrets.GITHUB_TOKEN / github.token. Then remove
283+
// from the OS environment to prevent subprocesses from extracting it via
284+
// /proc/<ppid>/environ or similar.
285+
if opts.OverrideSecrets == nil {
286+
opts.OverrideSecrets = make(map[string]string)
287+
}
288+
if _, exists := opts.OverrideSecrets["GITHUB_TOKEN"]; !exists {
289+
if ghToken, ok := opts.OverrideEnv["GITHUB_TOKEN"]; ok && ghToken != "" {
290+
opts.OverrideSecrets["GITHUB_TOKEN"] = ghToken
291+
} else if ghToken := os.Getenv("GITHUB_TOKEN"); ghToken != "" {
292+
opts.OverrideSecrets["GITHUB_TOKEN"] = ghToken
293+
} else if inputToken := os.Getenv("INPUT_GITHUB_TOKEN"); inputToken != "" {
294+
opts.OverrideSecrets["GITHUB_TOKEN"] = inputToken
295+
} else if inputToken := os.Getenv("INPUT_TOKEN"); inputToken != "" {
296+
opts.OverrideSecrets["GITHUB_TOKEN"] = inputToken
297+
}
298+
}
299+
delete(opts.OverrideEnv, "GITHUB_TOKEN")
300+
os.Unsetenv("GITHUB_TOKEN")
301+
os.Unsetenv("INPUT_GITHUB_TOKEN")
302+
os.Unsetenv("INPUT_TOKEN")
303+
280304
ag, errs := LoadGraph(graphYaml, nil, "", false, opts)
281305
if len(errs) > 0 {
282306
return CreateErr(nil, errs[0], "failed to load graph")
@@ -299,13 +323,13 @@ func RunGraph(ctx context.Context, graphName string, graphContent []byte, opts R
299323
isGitHubWorkflow := false
300324
if opts.OverrideEnv["GITHUB_ACTIONS"] == "true" {
301325
isGitHubWorkflow = true
302-
utils.LogOut.Infof("GitHub workflow detected via OverrideEnv")
326+
utils.LogOut.Info("GitHub workflow detected via OverrideEnv\n")
303327
} else if os.Getenv("GITHUB_ACTIONS") == "true" {
304328
isGitHubWorkflow = true
305-
utils.LogOut.Infof("GitHub workflow detected via GITHUB_ACTIONS environment variable (.env or shell)")
329+
utils.LogOut.Info("GitHub workflow detected via GITHUB_ACTIONS environment variable (.env or shell)\n")
306330
} else if entryNode.GetNodeTypeId() == "core/gh-start@v1" {
307331
isGitHubWorkflow = true
308-
utils.LogOut.Infof("GitHub workflow detected via entry node type: core/gh-start@v1")
332+
utils.LogOut.Info("GitHub workflow detected via entry node type: core/gh-start@v1\n")
309333
}
310334

311335
// mimickGitHubEnv: Determines if we need to set up a simulated GitHub environment. The easiest
@@ -406,7 +430,7 @@ func RunGraph(ctx context.Context, graphName string, graphContent []byte, opts R
406430
if m, err := decodeJsonFromEnvValue[any](v.Value); err == nil {
407431
needsTracker.set(m, source, true, true)
408432
}
409-
case isGitHubWorkflow && k == "ACT_INPUT_TOKEN":
433+
case isGitHubWorkflow && (k == "ACT_INPUT_TOKEN" || k == "ACT_INPUT_GITHUB_TOKEN"):
410434
secretTracker.setSingle("GITHUB_TOKEN", v.Value, source, true, true)
411435

412436
default:
@@ -440,17 +464,19 @@ func RunGraph(ctx context.Context, graphName string, graphContent []byte, opts R
440464
}
441465

442466
if mimickGitHubEnv {
443-
if cwd, ok := finalEnv["GITHUB_WORKSPACE"]; ok {
444-
newCwd = cwd
445-
utils.LogOut.Debugf("changing working directory to GITHUB_WORKSPACE: %s\n", newCwd)
446-
}
447-
448467
// If we are running a github actions workflow, then mimic a GitHub Actions environment
449468
// But only do is if we are NOT already in GitHub Actions
450469
err = SetupGitHubActionsEnv(finalEnv)
451470
if err != nil {
452471
return CreateErr(nil, err, "failed to setup GitHub Actions environment")
453472
}
473+
474+
// Use the updated GITHUB_WORKSPACE as the working directory.
475+
// SetupGitHubActionsEnv replaces GITHUB_WORKSPACE with a fresh temp folder.
476+
if cwd, ok := finalEnv["GITHUB_WORKSPACE"]; ok {
477+
newCwd = cwd
478+
utils.LogOut.Debugf("changing working directory to GITHUB_WORKSPACE: %s\n", newCwd)
479+
}
454480
} else if debugCb != nil && newCwd == "" {
455481
// for debug sessions, always create a temp working directory if none is set
456482
tmpDir, tmpErr := os.MkdirTemp("", "actrun-debug-*")

‎nodes/gh-action@v1.go‎

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -396,28 +396,14 @@ func init() {
396396
return nil, []error{core.CreateErr(nil, nil, "node representing GitHub Action '%v' can only be used in a GitHub Actions workflow.", nodeType)}
397397
}
398398

399-
// Reminder:
400-
// `INPUT_TOKEN` comes from the GitHub Action actionforge/action.
401-
// `GITHUB_TOKEN` is manually provided, eg through the web app and has a higher precedence.
402-
// GITHUB_TOKEN should always be set via secrets, but just in case the user provides it via env, check also there
403399
ghToken := opts.OverrideSecrets["GITHUB_TOKEN"]
404-
if ghToken == "" {
405-
ghToken = opts.OverrideEnv["GITHUB_TOKEN"]
406-
if ghToken == "" {
407-
ghToken = os.Getenv("GITHUB_TOKEN")
408-
if ghToken == "" {
409-
// Note that `INPUT_*` env vars are only prefixed for the graph execution, not here
410-
ghToken = os.Getenv("INPUT_TOKEN")
411-
}
412-
}
413-
}
414400

415401
// TODO: (Seb) for the validation process we only need the action.yml, not the entire repo
416402
// so check if we are in validate mode and only download the action.yml file
417403
_, err = os.Stat(actionRepoRoot)
418404
if errors.Is(err, os.ErrNotExist) {
419405
if ghToken == "" {
420-
return nil, []error{core.CreateErr(nil, nil, "neither GITHUB_TOKEN nor INPUT_TOKEN are set")}
406+
return nil, []error{core.CreateErr(nil, nil, "neither GITHUB_TOKEN nor INPUT_GITHUB_TOKEN are set")}
421407
}
422408

423409
cloneUrl := fmt.Sprintf("https://github.com/%s/%s", owner, repo)

‎tests_e2e/references/reference_app.sh_l12‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,19 +23,19 @@ hint:
2323

2424
stack trace:
2525
github.com/actionforge/actrun-cli/core.RunGraphFromFile
26-
graph.go:1123
26+
graph.go:-1
2727
github.com/actionforge/actrun-cli/cmd.cmdRootRun
28-
cmd_root.go:188
28+
cmd_root.go:-1
2929
github.com/spf13/cobra.(*Command).execute
3030
command.go:-1
3131
github.com/spf13/cobra.(*Command).ExecuteC
3232
command.go:-1
3333
github.com/spf13/cobra.(*Command).Execute
3434
command.go:-1
3535
github.com/actionforge/actrun-cli/cmd.Execute
36-
cmd_root.go:200
36+
cmd_root.go:-1
3737
main.main
38-
main.go:26
38+
main.go:-1
3939
runtime.main
4040
proc.go:-1
4141
runtime.goexit

‎tests_e2e/references/reference_dir-walk.sh_l56‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -32,31 +32,31 @@ error:
3232

3333
stack trace:
3434
github.com/actionforge/actrun-cli/nodes.(*WalkNode).ExecuteImpl
35-
dir-walk@v1.go:62
35+
dir-walk@v1.go:-1
3636
github.com/actionforge/actrun-cli/core.(*Executions).Execute
37-
executions.go:68
37+
executions.go:-1
3838
github.com/actionforge/actrun-cli/nodes.(*StartNode).ExecuteImpl
39-
start@v1.go:50
39+
start@v1.go:-1
4040
github.com/actionforge/actrun-cli/nodes.(*StartNode).ExecuteEntry
41-
start@v1.go:45
41+
start@v1.go:-1
4242
github.com/actionforge/actrun-cli/core.RunGraph
43-
graph.go:514
43+
graph.go:-1
4444
github.com/actionforge/actrun-cli/core.RunGraphFromString
45-
graph.go:1104
45+
graph.go:-1
4646
github.com/actionforge/actrun-cli/core.RunGraphFromFile
47-
graph.go:1126
47+
graph.go:-1
4848
github.com/actionforge/actrun-cli/cmd.cmdRootRun
49-
cmd_root.go:188
49+
cmd_root.go:-1
5050
github.com/spf13/cobra.(*Command).execute
5151
command.go:-1
5252
github.com/spf13/cobra.(*Command).ExecuteC
5353
command.go:-1
5454
github.com/spf13/cobra.(*Command).Execute
5555
command.go:-1
5656
github.com/actionforge/actrun-cli/cmd.Execute
57-
cmd_root.go:200
57+
cmd_root.go:-1
5858
main.main
59-
main.go:26
59+
main.go:-1
6060
runtime.main
6161
proc.go:-1
6262
runtime.goexit

‎tests_e2e/references/reference_error_no_output.sh_l8‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -33,41 +33,41 @@ hint:
3333

3434
stack trace:
3535
github.com/actionforge/actrun-cli/core.(*Outputs).OutputValueById
36-
outputs.go:114
36+
outputs.go:-1
3737
github.com/actionforge/actrun-cli/core.(*Inputs).InputValueById
38-
inputs.go:364
38+
inputs.go:-1
3939
github.com/actionforge/actrun-cli/core.inputValueById[...]
40-
inputs.go:483
40+
inputs.go:-1
4141
github.com/actionforge/actrun-cli/core.InputValueFromSubInputs[...]
42-
inputs.go:478
42+
inputs.go:-1
4343
github.com/actionforge/actrun-cli/core.InputArrayValueById[...]
44-
inputs.go:560
44+
inputs.go:-1
4545
github.com/actionforge/actrun-cli/nodes.(*PrintNode).ExecuteImpl
46-
print@v1.go:27
46+
print@v1.go:-1
4747
github.com/actionforge/actrun-cli/core.(*Executions).Execute
48-
executions.go:68
48+
executions.go:-1
4949
github.com/actionforge/actrun-cli/nodes.(*StartNode).ExecuteImpl
50-
start@v1.go:50
50+
start@v1.go:-1
5151
github.com/actionforge/actrun-cli/nodes.(*StartNode).ExecuteEntry
52-
start@v1.go:45
52+
start@v1.go:-1
5353
github.com/actionforge/actrun-cli/core.RunGraph
54-
graph.go:514
54+
graph.go:-1
5555
github.com/actionforge/actrun-cli/core.RunGraphFromString
56-
graph.go:1104
56+
graph.go:-1
5757
github.com/actionforge/actrun-cli/core.RunGraphFromFile
58-
graph.go:1126
58+
graph.go:-1
5959
github.com/actionforge/actrun-cli/cmd.cmdRootRun
60-
cmd_root.go:188
60+
cmd_root.go:-1
6161
github.com/spf13/cobra.(*Command).execute
6262
command.go:-1
6363
github.com/spf13/cobra.(*Command).ExecuteC
6464
command.go:-1
6565
github.com/spf13/cobra.(*Command).Execute
6666
command.go:-1
6767
github.com/actionforge/actrun-cli/cmd.Execute
68-
cmd_root.go:200
68+
cmd_root.go:-1
6969
main.main
70-
main.go:26
70+
main.go:-1
7171
runtime.main
7272
proc.go:-1
7373
runtime.goexit

0 commit comments

Comments
 (0)