fix: allow kubelet token symlink (#1805)

* Revert "chore: Update dist"

This reverts commit 5548f3441b.

* Revert "chore: document container credentials provider support (and delete transitive tags in AssumeRoleWithWebIdentity) (#1780)"

This reverts commit 77cd089899.

* Revert "chore: replay 6.2 devel changes onto main (#1800)"

This reverts commit 87eb0cf693.

* fix: allow kubelet token symlink

Closes #1804

test/helpers.test.ts

@@ -28,29 +28,6 @@ describe('Configure AWS Credentials helpers', {}, () => {
     await expect(helpers.retryAndBackoff(fn, false)).rejects.toMatch('i am not retryable');
     expect(fn).toHaveBeenCalledTimes(1);
   });
-  it('retries and logs with label at info level', {}, async () => {
-    helpers.withsleep(() => Promise.resolve());
-    const fn = vi.fn().mockRejectedValueOnce(new Error('transient')).mockResolvedValueOnce('success');
-    const result = await helpers.retryAndBackoff(fn, true, 3, 0, 50, 'TestOp');
-    expect(result).toBe('success');
-    expect(fn).toHaveBeenCalledTimes(2);
-    expect(core.info).toHaveBeenCalledWith(expect.stringContaining('Retry TestOp: attempt 1 of 3 failed'));
-    helpers.reset();
-  });
-  it('logs max retries reached with label', {}, async () => {
-    helpers.withsleep(() => Promise.resolve());
-    const fn = vi.fn().mockRejectedValue(new Error('persistent'));
-    await expect(helpers.retryAndBackoff(fn, true, 2, 0, 50, 'TestOp')).rejects.toThrow('persistent');
-    expect(core.info).toHaveBeenCalledWith(expect.stringContaining('Retry TestOp: reached max retries (2)'));
-    helpers.reset();
-  });
-  it('retries without a label (backward compat)', {}, async () => {
-    helpers.withsleep(() => Promise.resolve());
-    const fn = vi.fn().mockRejectedValueOnce(new Error('transient')).mockResolvedValueOnce('ok');
-    await helpers.retryAndBackoff(fn, true, 3);
-    expect(core.info).toHaveBeenCalledWith(expect.stringContaining('Retry: attempt 1 of 3 failed'));
-    helpers.reset();
-  });
   it('can output creds when told to', {}, () => {
     vi.spyOn(core, 'setOutput').mockImplementation(() => {});
     vi.spyOn(core, 'setSecret').mockImplementation(() => {});
@@ -107,13 +84,13 @@ describe('Configure AWS Credentials helpers', {}, () => {
   it('handles getBooleanInput correctly', {}, () => {
     vi.spyOn(core, 'getInput').mockReturnValue('true');
     expect(helpers.getBooleanInput('test')).toBe(true);
-
+    
     vi.spyOn(core, 'getInput').mockReturnValue('false');
     expect(helpers.getBooleanInput('test')).toBe(false);
-
+    
     vi.spyOn(core, 'getInput').mockReturnValue('');
     expect(helpers.getBooleanInput('test', { default: true })).toBe(true);
-
+    
     vi.spyOn(core, 'getInput').mockReturnValue('invalid');
     expect(() => helpers.getBooleanInput('test')).toThrow();
   });
@@ -177,6 +154,75 @@ describe('Configure AWS Credentials helpers', {}, () => {
         fs.mkdirSync('/dir/subdir', { recursive: true });
         expect(() => helpers.readFileUtf8('/dir/subdir')).toThrow(/not a regular file/);
       });
+
+      it.skipIf(process.platform === 'win32')(
+        'follows the kubelet projected-token symlink chain at /var/run/secrets/*/serviceaccount/token',
+        () => {
+          fs.mkdirSync('/var/run/secrets/eks.amazonaws.com/serviceaccount/..2026_05_28_00_00_00.123', {
+            recursive: true,
+          });
+          fs.writeFileSync(
+            '/var/run/secrets/eks.amazonaws.com/serviceaccount/..2026_05_28_00_00_00.123/token',
+            'jwt-token',
+          );
+          fs.symlinkSync(
+            '..2026_05_28_00_00_00.123',
+            '/var/run/secrets/eks.amazonaws.com/serviceaccount/..data',
+          );
+          fs.symlinkSync(
+            '..data/token',
+            '/var/run/secrets/eks.amazonaws.com/serviceaccount/token',
+          );
+          expect(helpers.readFileUtf8('/var/run/secrets/eks.amazonaws.com/serviceaccount/token')).toBe('jwt-token');
+        },
+      );
+
+      it.skipIf(process.platform === 'win32')(
+        'still refuses symlinks at lookalike paths outside the allowlist',
+        () => {
+          fs.mkdirSync('/var/run/secrets/eks.amazonaws.com/serviceaccount', { recursive: true });
+          fs.writeFileSync('/var/run/secrets/eks.amazonaws.com/serviceaccount/secret', 'jwt-token');
+          fs.symlinkSync(
+            '/var/run/secrets/eks.amazonaws.com/serviceaccount/secret',
+            '/var/run/secrets/eks.amazonaws.com/serviceaccount/token2',
+          );
+          expect(() =>
+            helpers.readFileUtf8('/var/run/secrets/eks.amazonaws.com/serviceaccount/token2'),
+          ).toThrow(/Refusing .* \(.* symbolic link\)/);
+        },
+      );
+    });
+
+    describe('isAllowListed', {}, () => {
+      it.skipIf(process.platform === 'win32')('matches the canonical kubelet projected-token path', () => {
+        expect(
+          helpers.isAllowListed('/var/run/secrets/eks.amazonaws.com/serviceaccount/token'),
+        ).toBe(true);
+        expect(
+          helpers.isAllowListed('/var/run/secrets/kubernetes.io/serviceaccount/token'),
+        ).toBe(true);
+      });
+
+      it.skipIf(process.platform === 'win32')('rejects nested or unrelated paths', () => {
+        expect(helpers.isAllowListed('/var/run/secrets/serviceaccount/token')).toBe(false);
+        expect(
+          helpers.isAllowListed('/var/run/secrets/a/b/serviceaccount/token'),
+        ).toBe(false);
+        expect(
+          helpers.isAllowListed('/var/run/secrets/eks.amazonaws.com/serviceaccount/token2'),
+        ).toBe(false);
+        expect(
+          helpers.isAllowListed('/etc/var/run/secrets/foo/serviceaccount/token'),
+        ).toBe(false);
+      });
+
+      it.skipIf(process.platform === 'win32')('normalizes path traversal attempts', () => {
+        expect(
+          helpers.isAllowListed(
+            '/var/run/secrets/foo/serviceaccount/../../../../etc/passwd',
+          ),
+        ).toBe(false);
+      });
     });
 
     describe('writeFileUtf8', {}, () => {