From 344f5cbe7ee9a12674d7e647f4075248d34268ff Mon Sep 17 00:00:00 2001 From: GitHub Actions Date: Fri, 31 Jan 2020 02:34:18 +0000 Subject: [PATCH] chore: Update dist --- dist/index.js | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/dist/index.js b/dist/index.js index ddf74c1..daf95b8 100644 --- a/dist/index.js +++ b/dist/index.js @@ -134,6 +134,8 @@ const util = __webpack_require__(1669); // That seems like a reasonable default to use if no role duration is defined. const MAX_ACTION_RUNTIME = 6 * 3600; const USER_AGENT = 'configure-aws-credentials-for-github-actions'; +const MAX_TAG_VALUE_LENGTH = 256; +const SANITIZATION_CHARACTER = '*' async function assumeRole(params) { // Assume a role to get short-lived credentials using longer-lived credentials. @@ -163,9 +165,9 @@ async function assumeRole(params) { Tags: [ {Key: 'GitHub', Value: 'Actions'}, {Key: 'Repository', Value: GITHUB_REPOSITORY}, - {Key: 'Workflow', Value: GITHUB_WORKFLOW}, + {Key: 'Workflow', Value: sanitizeGithubWorkflowName(GITHUB_WORKFLOW)}, {Key: 'Action', Value: GITHUB_ACTION}, - {Key: 'Actor', Value: GITHUB_ACTOR}, + {Key: 'Actor', Value: sanitizeGithubActor(GITHUB_ACTOR)}, {Key: 'Branch', Value: GITHUB_REF}, {Key: 'Commit', Value: GITHUB_SHA}, ] @@ -180,6 +182,21 @@ async function assumeRole(params) { }); } +function sanitizeGithubActor(actor) { + // In some circumstances the actor may contain square brackets. For example, if they're a bot ('[bot]') + // Square brackets are not allowed in AWS session tags + return actor.replace(/\[|\]/g, SANITIZATION_CHARACTER) +} + +function sanitizeGithubWorkflowName(name) { + // Workflow names can be almost any valid UTF-8 string, but tags are more restrictive. + // This replaces anything not conforming to the tag restrictions by inverting the regular expression. + // See the AWS documentation for constraint specifics https://docs.aws.amazon.com/STS/latest/APIReference/API_Tag.html. + const nameWithoutSpecialCharacters = name.replace(/[^\p{L}\p{Z}\p{N}_.:/=+-@]/gu, SANITIZATION_CHARACTER); + const nameTruncated = nameWithoutSpecialCharacters.slice(0, MAX_TAG_VALUE_LENGTH) + return nameTruncated +} + function exportCredentials(params){ // Configure the AWS CLI and AWS SDKs using environment variables and set them as secrets. // Setting the credentials as secrets masks them in Github Actions logs