Skip to content

Commit 9b01a34

Browse files
fix: prevent oidc on tokenless due to permissioning (#1724)
1 parent 47e0552 commit 9b01a34

File tree

5 files changed

+25
-8
lines changed

5 files changed

+25
-8
lines changed

CHANGELOG.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -993,4 +993,4 @@ for the full list.
993993
### Dependencies and Misc
994994
- #166 Bump requestretry from 4.1.1 to 4.1.2
995995
- #169 Bump typescript from 4.0.5 to 4.1.2
996-
- #178 Bump @types/jest from 26.0.15 to 26.0.19
996+
- #178 Bump @types/jest from 26.0.15 to 26.0.19

Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
deploy:
2-
$(eval VERSION := $(shell cat src/version | grep 'CODECOV_ACTION_VERSION=' | cut -d\" -f2))
2+
$(eval VERSION := $(shell cat src/version))
33
git tag -d v5
44
git push origin :v5
55
git tag v5

action.yml

+21-3
Original file line numberDiff line numberDiff line change
@@ -157,28 +157,46 @@ runs:
157157
- name: Action version
158158
shell: bash
159159
run: |
160-
CC_ACTION_VERSION=$(cat ${GITHUB_ACTION_PATH}/src/version | grep 'CODECOV_ACTION_VERSION=' | cut -d\" -f2)
160+
CC_ACTION_VERSION=$(cat ${GITHUB_ACTION_PATH}/src/version)
161161
echo -e "\033[0;32m==>\033[0m Running Action version $CC_ACTION_VERSION"
162162
- name: Set safe directory
163163
if: ${{ inputs.disable_safe_directory != 'true' }}
164164
shell: bash
165165
run: |
166166
git config --global --add safe.directory ${{ github.workspace }}
167167
168+
- name: Set fork
169+
shell: bash
170+
run: |
171+
if [ -n "$GITHUB_EVENT_PULL_REQUEST_HEAD_REPO_FULL_NAME" ] && [ "${GITHUB_EVENT_PULL_REQUEST_HEAD_REPO_FULL_NAME}" != "$GITHUB_REPOSITORY" ];
172+
then
173+
echo -e "\033[0;32m==>\033[0m Fork detected"
174+
CC_FORK="true"
175+
echo "CC_FORK=$CC_FORK" >> "$GITHUB_ENV"
176+
fi
177+
env:
178+
GITHUB_EVENT_PULL_REQUEST_HEAD_LABEL: ${{ github.event.pull_request.head.label }}
179+
GITHUB_EVENT_PULL_REQUEST_HEAD_REPO_FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }}
180+
GITHUB_REPOSITORY: ${{ github.repository }}
181+
182+
168183
- name: Get and set token
169184
shell: bash
170185
run: |
171-
if [ "${{ inputs.use_oidc }}" == 'true' ];
186+
if [ "${{ inputs.use_oidc }}" == 'true' && "$CC_FORK" != 'true'];
172187
then
173188
# {"count":1984,"value":"***"}
189+
echo -e "\033[0;32m==>\033[0m Requesting OIDC token from ${ACTION_ID_TOKEN_REQUEST_URL}"
174190
CC_TOKEN=$(curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=https://codecov.io" | cut -d\" -f6)
175191
echo "CC_TOKEN=$CC_TOKEN" >> "$GITHUB_ENV"
176192
elif [ -n "${{ env.CODECOV_TOKEN }}" ];
177193
then
194+
echo -e "\033[0;32m==>\033[0m Token from from env"
178195
echo "CC_TOKEN=${{ env.CODECOV_TOKEN }}" >> "$GITHUB_ENV"
179196
else
180197
if [ -n "${{ inputs.token }}" ];
181198
then
199+
echo -e "\033[0;32m==>\033[0m Token set from input"
182200
CC_TOKEN=$(echo "${{ inputs.token }}" | tr -d '\n')
183201
echo "CC_TOKEN=$CC_TOKEN" >> "$GITHUB_ENV"
184202
fi
@@ -187,7 +205,7 @@ runs:
187205
- name: Override branch for forks
188206
shell: bash
189207
run: |
190-
if [ -z "$CC_BRANCH" ] && [ -z "$CC_TOKEN" ] && [ -n "$GITHUB_EVENT_PULL_REQUEST_HEAD_REPO_FULL_NAME" ] && [ "${GITHUB_EVENT_PULL_REQUEST_HEAD_REPO_FULL_NAME}" != "$GITHUB_REPOSITORY" ];
208+
if [ -z "$CC_BRANCH" ] && [ -z "$CC_TOKEN" ] && [ "$CC_FORK" == 'true' ]
191209
then
192210
echo -e "\033[0;32m==>\033[0m Fork detected, tokenless uploading used"
193211
TOKENLESS="$GITHUB_EVENT_PULL_REQUEST_HEAD_LABEL"

changelog.py

+1-2
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,7 @@
44

55
def update_changelog():
66
with open('src/version', 'r') as f:
7-
raw_version = f.read()
8-
version = re.search('\"(.*)\"', raw_version).groups()[0]
7+
version = f.read()
98
changelog = [f"## v{version}"]
109
changelog.append("### What\'s Changed")
1110

src/version

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
CODECOV_ACTION_VERSION="5.1.1"
1+
5.1.1

0 commit comments

Comments
 (0)