fix: allow kubelet token symlink (#1805)

* Revert "chore: Update dist"

This reverts commit 5548f3441b.

* Revert "chore: document container credentials provider support (and delete transitive tags in AssumeRoleWithWebIdentity) (#1780)"

This reverts commit 77cd089899.

* Revert "chore: replay 6.2 devel changes onto main (#1800)"

This reverts commit 87eb0cf693.

* fix: allow kubelet token symlink

Closes #1804

src/assumeRole.ts

@@ -42,7 +42,6 @@ async function assumeRoleWithWebIdentityTokenFile(
   core.info('Assuming role with web identity token file');
   try {
     delete params.Tags;
-    delete params.TransitiveTagKeys;
     const creds = await client.send(
       new AssumeRoleWithWebIdentityCommand({
         ...params,
@@ -78,98 +77,6 @@ export interface assumeRoleParams {
   webIdentityToken?: string;
   inlineSessionPolicy?: string;
   managedSessionPolicies?: { arn: string }[];
-  customTags?: string;
-}
-
-const TAG_KEY_REGEX = /^[\p{L}\p{Z}\p{N}_.:/=+\-@]+$/u;
-const TAG_VALUE_REGEX = /^[\p{L}\p{Z}\p{N}_.:/=+\-@]*$/u;
-const MAX_TAG_KEY_LENGTH = 128;
-const MAX_TAG_VALUE_LENGTH = 256;
-const MAX_SESSION_TAGS = 50;
-
-// Identity/audit primitives. Always emitted and cannot be overridden by custom-tags.
-const PROTECTED_TAG_SOURCES: ReadonlyArray<{ key: string; envVar: string }> = [
-  { key: 'Repository', envVar: 'GITHUB_REPOSITORY' },
-  { key: 'Workflow', envVar: 'GITHUB_WORKFLOW' },
-  { key: 'Action', envVar: 'GITHUB_ACTION' },
-  { key: 'Actor', envVar: 'GITHUB_ACTOR' },
-  { key: 'Commit', envVar: 'GITHUB_SHA' },
-  { key: 'Branch', envVar: 'GITHUB_REF' },
-];
-
-// Convenience metadata. Custom-tags may override (suppresses the default for that key).
-// Listed in priority order; lower-priority entries are dropped first if the user's custom-tags
-// would push the total above MAX_SESSION_TAGS.
-const OVERRIDEABLE_TAG_SOURCES_BY_PRIORITY: ReadonlyArray<{ key: string; envVar: string }> = [
-  { key: 'EventName', envVar: 'GITHUB_EVENT_NAME' },
-  { key: 'BaseRef', envVar: 'GITHUB_BASE_REF' },
-  { key: 'HeadRef', envVar: 'GITHUB_HEAD_REF' },
-  { key: 'RefName', envVar: 'GITHUB_REF_NAME' },
-  { key: 'RunId', envVar: 'GITHUB_RUN_ID' },
-  { key: 'RefType', envVar: 'GITHUB_REF_TYPE' },
-  { key: 'Job', envVar: 'GITHUB_JOB' },
-  { key: 'TriggeringActor', envVar: 'GITHUB_TRIGGERING_ACTOR' },
-];
-
-const PROTECTED_TAG_KEYS = new Set<string>(['GitHub', ...PROTECTED_TAG_SOURCES.map((s) => s.key)]);
-
-export function parseAndValidateCustomTags(customTags: string, existingTags: Tag[]): Tag[] {
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(customTags);
-  } catch {
-    throw new Error('custom-tags: input is not valid JSON');
-  }
-
-  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
-    throw new Error('custom-tags: input must be a JSON object (not an array or primitive)');
-  }
-
-  const newTags: Tag[] = [];
-
-  for (const [key, value] of Object.entries(parsed)) {
-    if (typeof value === 'object') {
-      throw new Error(
-        `custom-tags: value for key '${key}' must be a string, number, or boolean (not an object or array)`,
-      );
-    }
-
-    const stringValue = String(value);
-
-    if (key.length === 0 || key.length > MAX_TAG_KEY_LENGTH) {
-      throw new Error(`custom-tags: key '${key}' must be between 1 and ${MAX_TAG_KEY_LENGTH} characters`);
-    }
-    if (stringValue.length > MAX_TAG_VALUE_LENGTH) {
-      throw new Error(
-        `custom-tags: value for key '${key}' exceeds maximum length of ${MAX_TAG_VALUE_LENGTH} characters`,
-      );
-    }
-    if (!TAG_KEY_REGEX.test(key)) {
-      throw new Error(
-        `custom-tags: key '${key}' contains invalid characters. Allowed: unicode letters, digits, spaces, and _.:/=+-@`,
-      );
-    }
-    if (stringValue.length > 0 && !TAG_VALUE_REGEX.test(stringValue)) {
-      throw new Error(
-        `custom-tags: value for key '${key}' contains invalid characters. Allowed: unicode letters, digits, spaces, and _.:/=+-@`,
-      );
-    }
-    if (PROTECTED_TAG_KEYS.has(key)) {
-      throw new Error(
-        `custom-tags: key '${key}' conflicts with a protected session tag set by this action and cannot be overridden`,
-      );
-    }
-
-    newTags.push({ Key: key, Value: stringValue });
-  }
-
-  if (existingTags.length + newTags.length > MAX_SESSION_TAGS) {
-    throw new Error(
-      `custom-tags: total session tags (${existingTags.length + newTags.length}) would exceed the AWS limit of ${MAX_SESSION_TAGS}`,
-    );
-  }
-
-  return newTags;
 }
 
 export async function assumeRole(params: assumeRoleParams) {
@@ -186,7 +93,6 @@ export async function assumeRole(params: assumeRoleParams) {
     webIdentityToken,
     inlineSessionPolicy,
     managedSessionPolicies,
-    customTags,
   } = { ...params };
 
   // Load GitHub environment variables
@@ -195,37 +101,26 @@ export async function assumeRole(params: assumeRoleParams) {
     throw new Error('Missing required environment variables. Are you running in GitHub Actions?');
   }
 
-  // Build session tags. Values are sanitized because the AWS tag value spec is more
-  // restrictive than permissible characters in environment variables.
-  const protectedTags: Tag[] = [{ Key: 'GitHub', Value: 'Actions' }];
-  for (const { key, envVar } of PROTECTED_TAG_SOURCES) {
-    const value = process.env[envVar];
-    if (value) {
-      protectedTags.push({ Key: key, Value: sanitizeGitHubVariables(value) });
-    }
+  // Load role session tags
+  const tagArray: Tag[] = [
+    { Key: 'GitHub', Value: 'Actions' },
+    { Key: 'Repository', Value: GITHUB_REPOSITORY },
+    { Key: 'Workflow', Value: sanitizeGitHubVariables(GITHUB_WORKFLOW) },
+    { Key: 'Action', Value: GITHUB_ACTION },
+    { Key: 'Actor', Value: sanitizeGitHubVariables(GITHUB_ACTOR) },
+    { Key: 'Commit', Value: GITHUB_SHA },
+  ];
+  if (process.env.GITHUB_REF) {
+    tagArray.push({
+      Key: 'Branch',
+      Value: sanitizeGitHubVariables(process.env.GITHUB_REF),
+    });
   }
-
-  const parsedCustomTags: Tag[] = customTags ? parseAndValidateCustomTags(customTags, protectedTags) : [];
-  const customTagKeys = new Set(parsedCustomTags.map((t) => t.Key));
-
-  const availableOverrideableSlots = MAX_SESSION_TAGS - protectedTags.length - parsedCustomTags.length;
-  const overrideableTags: Tag[] = [];
-  for (const { key, envVar } of OVERRIDEABLE_TAG_SOURCES_BY_PRIORITY) {
-    if (overrideableTags.length >= availableOverrideableSlots) break;
-    if (customTagKeys.has(key)) continue;
-    const value = process.env[envVar];
-    if (value) {
-      overrideableTags.push({ Key: key, Value: sanitizeGitHubVariables(value) });
-    }
-  }
-
-  const tagArray: Tag[] = [...protectedTags, ...overrideableTags, ...parsedCustomTags];
-
   const tags = roleSkipSessionTagging ? undefined : tagArray;
   if (!tags) {
     core.debug('Role session tagging has been skipped.');
   } else {
-    core.debug(`${tags.length} role session tags are being used:`);
+    core.debug(`${tags.length} role session tags are being used.`);
   }
 
   //only populate transitiveTagKeys array if user is actually using session tagging