aws-actions/configure-aws-credentials
1
0
Fork 0
mirror of https://github.com/aws-actions/configure-aws-credentials.git synced 2026-09-03 06:05:04 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix: omit account IDs from the allowed-account-ids failure message

Browse Source 
The mismatch error is thrown before exportAccountId registers the
account-id mask, so setFailed wrote the raw account ID (and the
configured allow-list) into a public annotation. (C4)
This commit is contained in:
Tom Keller
2026-08-31 12:03:31 -07:00
parent a05dfa82bd
commit 4b8b5e37b4
2 changed files with 7 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/helpers.ts
+2 -5
View File
@@ -171,11 +171,8 @@ export function validateAccountId(expectedAccountIds: string[] | undefined, acco
return; return;
} }
if (!account || !allowedAccountIds.includes(account)) { if (!account || !allowedAccountIds.includes(account)) {
throw new Error( // Account IDs are deliberately omitted: this error reaches the job log before any mask exists.
`The account ID of the provided credentials (${ throw new Error('The account ID of the provided credentials does not match any of the allowed account IDs');
account ?? 'unknown'
}) does not match any of the expected account IDs: ${allowedAccountIds.join(', ')}`,
);
} }
} }
test/index.test.ts
+5 -5
View File
@@ -841,7 +841,7 @@ describe('Configure AWS Credentials', {}, () => {
await run(); await run();
expect(core.setFailed).toHaveBeenCalledWith( expect(core.setFailed).toHaveBeenCalledWith(
'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999', 'The account ID of the provided credentials does not match any of the allowed account IDs',
); );
}); });
@@ -861,7 +861,7 @@ describe('Configure AWS Credentials', {}, () => {
await run(); await run();
expect(core.setFailed).toHaveBeenCalledWith( expect(core.setFailed).toHaveBeenCalledWith(
'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999, 888888888888', 'The account ID of the provided credentials does not match any of the allowed account IDs',
); );
}); });
@@ -917,7 +917,7 @@ describe('Configure AWS Credentials', {}, () => {
await run(); await run();
expect(core.setFailed).toHaveBeenCalledWith( expect(core.setFailed).toHaveBeenCalledWith(
'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999', 'The account ID of the provided credentials does not match any of the allowed account IDs',
); );
}); });
@@ -936,7 +936,7 @@ describe('Configure AWS Credentials', {}, () => {
await run(); await run();
expect(core.setFailed).toHaveBeenCalledWith( expect(core.setFailed).toHaveBeenCalledWith(
'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999', 'The account ID of the provided credentials does not match any of the allowed account IDs',
); );
}); });
@@ -956,7 +956,7 @@ describe('Configure AWS Credentials', {}, () => {
await run(); await run();
expect(core.setFailed).toHaveBeenCalledWith( expect(core.setFailed).toHaveBeenCalledWith(
'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999', 'The account ID of the provided credentials does not match any of the allowed account IDs',
); );
}); });