aws-actions/configure-aws-credentials
1
0
Fork 0
mirror of https://github.com/aws-actions/configure-aws-credentials.git synced 2026-09-01 05:45:06 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix: omit account IDs from the allowed-account-ids failure message

Browse Source 
The mismatch error is thrown before exportAccountId registers the
account-id mask, so setFailed wrote the raw account ID (and the
configured allow-list) into a public annotation. (C4)
This commit is contained in:
Tom Keller
2026-08-31 12:03:31 -07:00
parent a05dfa82bd
commit 4b8b5e37b4
2 changed files with 7 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/helpers.ts
+2 -5
View File
@@ -171,11 +171,8 @@ export function validateAccountId(expectedAccountIds: string[] | undefined, acco
return;
}
if (!account || !allowedAccountIds.includes(account)) {
throw new Error(
`The account ID of the provided credentials (${
account ?? 'unknown'
}) does not match any of the expected account IDs: ${allowedAccountIds.join(', ')}`,
);
// Account IDs are deliberately omitted: this error reaches the job log before any mask exists.
throw new Error('The account ID of the provided credentials does not match any of the allowed account IDs');
}
}
test/index.test.ts
+5 -5
View File
@@ -841,7 +841,7 @@ describe('Configure AWS Credentials', {}, () => {
await run();
expect(core.setFailed).toHaveBeenCalledWith(
'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999',
'The account ID of the provided credentials does not match any of the allowed account IDs',
);
});
@@ -861,7 +861,7 @@ describe('Configure AWS Credentials', {}, () => {
await run();
expect(core.setFailed).toHaveBeenCalledWith(
'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999, 888888888888',
'The account ID of the provided credentials does not match any of the allowed account IDs',
);
});
@@ -917,7 +917,7 @@ describe('Configure AWS Credentials', {}, () => {
await run();
expect(core.setFailed).toHaveBeenCalledWith(
'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999',
'The account ID of the provided credentials does not match any of the allowed account IDs',
);
});
@@ -936,7 +936,7 @@ describe('Configure AWS Credentials', {}, () => {
await run();
expect(core.setFailed).toHaveBeenCalledWith(
'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999',
'The account ID of the provided credentials does not match any of the allowed account IDs',
);
});
@@ -956,7 +956,7 @@ describe('Configure AWS Credentials', {}, () => {
await run();
expect(core.setFailed).toHaveBeenCalledWith(
'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999',
'The account ID of the provided credentials does not match any of the allowed account IDs',
);
});