chore: unstage devel changes (#1786)

* Revert "chore: Update dist" This reverts commit e8614cfbf0. * Revert "chore(deps): bump @aws-sdk/client-sts from 3.1045.0 to 3.1049.0 (#1782)" This reverts commit 4684f47f89. * Revert "chore: Update dist" This reverts commit 48b8685c96. * Revert "chore(deps-dev): bump @smithy/property-provider from 4.3.1 to 4.3.3 (#1783)" This reverts commit fe6ad3af19. * Revert "chore: Update dist" This reverts commit 2520c5e921. * Revert "chore(deps-dev): bump @aws-sdk/credential-provider-env (#1784)" This reverts commit bc1093db1d. * Revert "chore(deps-dev): bump @types/node from 25.7.0 to 25.9.0 (#1785)" This reverts commit ffde832a1d. * Revert "chore: Update dist" This reverts commit 707acd96f6. * Revert "chore(deps): bump @smithy/node-http-handler from 4.7.1 to 4.7.3 (#1781)" This reverts commit a7c33ae483. * Revert "chore: update README for additional claim support (#1779)" This reverts commit 713aaabfec. * Revert "chore: Update dist" This reverts commit e6e8eba750. * Revert "fix: skip credential check on output-env-credentials: false (#1778)" This reverts commit 58e7c47adf. * Revert "chore: document forgejo compatibility (#1776)" This reverts commit f35a7d7d7e. * Revert "chore: Update dist" This reverts commit 3884f59ecd. * Revert "feat: add additional session tags by default (#1775)" This reverts commit e0ba768507. * Revert "chore: Update dist" This reverts commit 6795889618. * Revert "feat: expose run id in STS client user-agent (#1774)" This reverts commit 29d1be3027. * Revert "chore(deps-dev): bump @types/node from 25.6.0 to 25.7.0 (#1773)" This reverts commit ef734cca81. * Revert "chore(deps-dev): bump @biomejs/biome from 2.4.14 to 2.4.15 (#1772)" This reverts commit 7521c55910. * Revert "chore: Update dist" This reverts commit c0e2737f14. * Revert "chore(deps): bump @smithy/node-http-handler from 4.6.1 to 4.7.1 (#1770)" This reverts commit dbd503f368. * Revert "chore: Update dist" This reverts commit 18a236fbd1. * Revert "chore(deps-dev): bump @smithy/property-provider from 4.2.14 to 4.3.1 (#1771)" This reverts commit 1ab31502aa. * Revert "chore(deps-dev): bump @vitest/coverage-v8 from 4.1.5 to 4.1.6 (#1768)" This reverts commit 1fb495c4b2. * Revert "chore: Update dist" This reverts commit 1e8fec8ea1. * Revert "chore(deps): bump @aws-sdk/client-sts from 3.1044.0 to 3.1045.0 (#1767)" This reverts commit a388f23f7d. * Revert "chore: update documentation for environment workflows (#1766)" This reverts commit 3f7e1b63d7. * Revert "feat: add regex validation to role-session-name (#1765)" This reverts commit e35449909c. * Revert "chore: Update dist" This reverts commit 958a80fc34. * Revert "feat: add more retry logic and better logging (#1764)" This reverts commit 540d0c13ae. * Revert "chore: automate README version bumping (#1763)" This reverts commit 07ada0fe07. * Revert "chore: Update dist" This reverts commit f8d4eb68a9. * Revert "feat: support custom STS endpoints (#1762)" This reverts commit 8d52d05d7a. * Revert "chore: Update dist" This reverts commit 681892c11b. * Revert "chore: configure codeql to ignore generated code (#1760)" This reverts commit dc2353e57a. * Revert "feat: Allow custom session tags to be passed when assuming a role (#1759)" This reverts commit 61f50f630f. * Revert "chore: automatic major version tagging (#1565)" This reverts commit c36525a567. * Revert "chore: bump unit test node version (#1758)" This reverts commit 39d1702721. * Revert "chore(deps): bump @aws-sdk/client-sts from 3.1043.0 to 3.1044.0 (#1754)" This reverts commit 4cfda40a13. * Revert "chore(deps-dev): bump @biomejs/biome from 2.4.13 to 2.4.14 (#1756)" This reverts commit 8856e12f3a. * Revert "chore(deps): bump @actions/core from 2.0.3 to 3.0.1 (#1746)" This reverts commit 64d8e82527. * Revert "chore(deps-dev): bump vitest from 3.2.4 to 4.1.5 (#1748)" This reverts commit 78f374f6d1.
2026-09-04 06:15:07 +09:00 · 2026-05-25 12:19:31 -07:00
parent e8614cfbf0
commit 3cc0e19239
20 changed files with 24501 additions and 21311 deletions
@@ -78,98 +78,6 @@ export interface assumeRoleParams {
  webIdentityToken?: string;
  inlineSessionPolicy?: string;
  managedSessionPolicies?: { arn: string }[];
-  customTags?: string;
-}
-
-const TAG_KEY_REGEX = /^[\p{L}\p{Z}\p{N}_.:/=+\-@]+$/u;
-const TAG_VALUE_REGEX = /^[\p{L}\p{Z}\p{N}_.:/=+\-@]*$/u;
-const MAX_TAG_KEY_LENGTH = 128;
-const MAX_TAG_VALUE_LENGTH = 256;
-const MAX_SESSION_TAGS = 50;
-
-// Identity/audit primitives. Always emitted and cannot be overridden by custom-tags.
-const PROTECTED_TAG_SOURCES: ReadonlyArray<{ key: string; envVar: string }> = [
-  { key: 'Repository', envVar: 'GITHUB_REPOSITORY' },
-  { key: 'Workflow', envVar: 'GITHUB_WORKFLOW' },
-  { key: 'Action', envVar: 'GITHUB_ACTION' },
-  { key: 'Actor', envVar: 'GITHUB_ACTOR' },
-  { key: 'Commit', envVar: 'GITHUB_SHA' },
-  { key: 'Branch', envVar: 'GITHUB_REF' },
-];
-
-// Convenience metadata. Custom-tags may override (suppresses the default for that key).
-// Listed in priority order; lower-priority entries are dropped first if the user's custom-tags
-// would push the total above MAX_SESSION_TAGS.
-const OVERRIDEABLE_TAG_SOURCES_BY_PRIORITY: ReadonlyArray<{ key: string; envVar: string }> = [
-  { key: 'EventName', envVar: 'GITHUB_EVENT_NAME' },
-  { key: 'BaseRef', envVar: 'GITHUB_BASE_REF' },
-  { key: 'HeadRef', envVar: 'GITHUB_HEAD_REF' },
-  { key: 'RefName', envVar: 'GITHUB_REF_NAME' },
-  { key: 'RunId', envVar: 'GITHUB_RUN_ID' },
-  { key: 'RefType', envVar: 'GITHUB_REF_TYPE' },
-  { key: 'Job', envVar: 'GITHUB_JOB' },
-  { key: 'TriggeringActor', envVar: 'GITHUB_TRIGGERING_ACTOR' },
-];
-
-const PROTECTED_TAG_KEYS = new Set<string>(['GitHub', ...PROTECTED_TAG_SOURCES.map((s) => s.key)]);
-
-export function parseAndValidateCustomTags(customTags: string, existingTags: Tag[]): Tag[] {
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(customTags);
-  } catch {
-    throw new Error('custom-tags: input is not valid JSON');
-  }
-
-  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
-    throw new Error('custom-tags: input must be a JSON object (not an array or primitive)');
-  }
-
-  const newTags: Tag[] = [];
-
-  for (const [key, value] of Object.entries(parsed)) {
-    if (typeof value === 'object') {
-      throw new Error(
-        `custom-tags: value for key '${key}' must be a string, number, or boolean (not an object or array)`,
-      );
-    }
-
-    const stringValue = String(value);
-
-    if (key.length === 0 || key.length > MAX_TAG_KEY_LENGTH) {
-      throw new Error(`custom-tags: key '${key}' must be between 1 and ${MAX_TAG_KEY_LENGTH} characters`);
-    }
-    if (stringValue.length > MAX_TAG_VALUE_LENGTH) {
-      throw new Error(
-        `custom-tags: value for key '${key}' exceeds maximum length of ${MAX_TAG_VALUE_LENGTH} characters`,
-      );
-    }
-    if (!TAG_KEY_REGEX.test(key)) {
-      throw new Error(
-        `custom-tags: key '${key}' contains invalid characters. Allowed: unicode letters, digits, spaces, and _.:/=+-@`,
-      );
-    }
-    if (stringValue.length > 0 && !TAG_VALUE_REGEX.test(stringValue)) {
-      throw new Error(
-        `custom-tags: value for key '${key}' contains invalid characters. Allowed: unicode letters, digits, spaces, and _.:/=+-@`,
-      );
-    }
-    if (PROTECTED_TAG_KEYS.has(key)) {
-      throw new Error(
-        `custom-tags: key '${key}' conflicts with a protected session tag set by this action and cannot be overridden`,
-      );
-    }
-
-    newTags.push({ Key: key, Value: stringValue });
-  }
-
-  if (existingTags.length + newTags.length > MAX_SESSION_TAGS) {
-    throw new Error(
-      `custom-tags: total session tags (${existingTags.length + newTags.length}) would exceed the AWS limit of ${MAX_SESSION_TAGS}`,
-    );
-  }
-
-  return newTags;
 }

 export async function assumeRole(params: assumeRoleParams) {
@@ -186,7 +94,6 @@ export async function assumeRole(params: assumeRoleParams) {
    webIdentityToken,
    inlineSessionPolicy,
    managedSessionPolicies,
-    customTags,
  } = { ...params };

  // Load GitHub environment variables
@@ -195,37 +102,26 @@ export async function assumeRole(params: assumeRoleParams) {
    throw new Error('Missing required environment variables. Are you running in GitHub Actions?');
  }

-  // Build session tags. Values are sanitized because the AWS tag value spec is more
-  // restrictive than permissible characters in environment variables.
-  const protectedTags: Tag[] = [{ Key: 'GitHub', Value: 'Actions' }];
-  for (const { key, envVar } of PROTECTED_TAG_SOURCES) {
-    const value = process.env[envVar];
-    if (value) {
-      protectedTags.push({ Key: key, Value: sanitizeGitHubVariables(value) });
-    }
+  // Load role session tags
+  const tagArray: Tag[] = [
+    { Key: 'GitHub', Value: 'Actions' },
+    { Key: 'Repository', Value: GITHUB_REPOSITORY },
+    { Key: 'Workflow', Value: sanitizeGitHubVariables(GITHUB_WORKFLOW) },
+    { Key: 'Action', Value: GITHUB_ACTION },
+    { Key: 'Actor', Value: sanitizeGitHubVariables(GITHUB_ACTOR) },
+    { Key: 'Commit', Value: GITHUB_SHA },
+  ];
+  if (process.env.GITHUB_REF) {
+    tagArray.push({
+      Key: 'Branch',
+      Value: sanitizeGitHubVariables(process.env.GITHUB_REF),
+    });
  }
-
-  const parsedCustomTags: Tag[] = customTags ? parseAndValidateCustomTags(customTags, protectedTags) : [];
-  const customTagKeys = new Set(parsedCustomTags.map((t) => t.Key));
-
-  const availableOverrideableSlots = MAX_SESSION_TAGS - protectedTags.length - parsedCustomTags.length;
-  const overrideableTags: Tag[] = [];
-  for (const { key, envVar } of OVERRIDEABLE_TAG_SOURCES_BY_PRIORITY) {
-    if (overrideableTags.length >= availableOverrideableSlots) break;
-    if (customTagKeys.has(key)) continue;
-    const value = process.env[envVar];
-    if (value) {
-      overrideableTags.push({ Key: key, Value: sanitizeGitHubVariables(value) });
-    }
-  }
-
-  const tagArray: Tag[] = [...protectedTags, ...overrideableTags, ...parsedCustomTags];
-
  const tags = roleSkipSessionTagging ? undefined : tagArray;
  if (!tags) {
    core.debug('Role session tagging has been skipped.');
  } else {
-    core.debug(`${tags.length} role session tags are being used:`);
+    core.debug(`${tags.length} role session tags are being used.`);
  }

  //only populate transitiveTagKeys array if user is actually using session tagging