implement last changes for vNext

src/index.ts

@@ -1,7 +1,14 @@
 import * as core from '@actions/core';
 import { assumeRole } from './assumeRole';
 import { CredentialsClient } from './CredentialsClient';
-import { errorMessage, retryAndBackoff, exportRegion, exportCredentials, exportAccountId } from './helpers';
+import {
+  errorMessage,
+  retryAndBackoff,
+  exportRegion,
+  exportCredentials,
+  exportAccountId,
+  unsetCredentials,
+} from './helpers';
 
 const DEFAULT_ROLE_DURATION = 3600; // One hour (seconds)
 const ROLE_SESSION_NAME = 'GitHubActions';
@@ -26,12 +33,18 @@ export async function run() {
     const roleSkipSessionTaggingInput = core.getInput('role-skip-session-tagging', { required: false }) || 'false';
     const roleSkipSessionTagging = roleSkipSessionTaggingInput.toLowerCase() === 'true';
     const proxyServer = core.getInput('http-proxy', { required: false });
-    const disableOIDC = core.getInput('disable-oidc', { required: false });
     const inlineSessionPolicy = core.getInput('inline-session-policy', { required: false });
     const managedSessionPoliciesInput = core.getMultilineInput('managed-session-policies', { required: false });
     const managedSessionPolicies: any[] = [];
     const roleChainingInput = core.getInput('role-chaining', { required: false }) || 'false';
     const roleChaining = roleChainingInput.toLowerCase() === 'true';
+    const outputCredentialsInput = core.getInput('output-credentials', { required: false }) || 'false';
+    const outputCredentials = outputCredentialsInput.toLowerCase() === 'true';
+    const unsetCurrentCredentialsInput = core.getInput('unset-current-credentials', { required: false }) || 'false';
+    const unsetCurrentCredentials = unsetCurrentCredentialsInput.toLowerCase() === 'true';
+    const disableRetryInput = core.getInput('disable-retry', { required: false }) || 'false';
+    const disableRetry = disableRetryInput.toLowerCase() === 'true';
+    const maxRetries = parseInt(core.getInput('retry-max-attempts', { required: false })) || 12;
     for (const managedSessionPolicy of managedSessionPoliciesInput) {
       managedSessionPolicies.push({ arn: managedSessionPolicy });
     }
@@ -41,12 +54,11 @@ export async function run() {
       // The `ACTIONS_ID_TOKEN_REQUEST_TOKEN` environment variable is set when the `id-token` permission is granted.
       // This is necessary to authenticate with OIDC, but not strictly set just for OIDC. If it is not set and all other
       // checks pass, it is likely but not guaranteed that the user needs but lacks this permission in their workflow.
-      // So, we will log a warning when it is the only piece absent, as well as add an opportunity to manually disable the entire check.
+      // So, we will log a warning when it is the only piece absent
       if (
         !!roleToAssume &&
         !webIdentityTokenFile &&
         !AccessKeyId &&
-        !disableOIDC &&
         !process.env['ACTIONS_ID_TOKEN_REQUEST_TOKEN'] &&
         !roleChaining
       ) {
@@ -59,11 +71,14 @@ export async function run() {
         !!process.env['ACTIONS_ID_TOKEN_REQUEST_TOKEN'] &&
         !AccessKeyId &&
         !webIdentityTokenFile &&
-        !disableOIDC &&
         !roleChaining
       );
     };
 
+    if (unsetCurrentCredentials) {
+      unsetCredentials();
+    }
+
     if (!region.match(REGION_REGEX)) {
       throw new Error(`Region is not valid: ${region}`);
     }
@@ -101,23 +116,27 @@ export async function run() {
 
     // Get role credentials if configured to do so
     if (roleToAssume) {
-      const roleCredentials = await retryAndBackoff(async () => {
-        return assumeRole({
-          credentialsClient,
-          sourceAccountId,
-          roleToAssume,
-          roleExternalId,
-          roleDuration,
-          roleSessionName,
-          roleSkipSessionTagging,
-          webIdentityTokenFile,
-          webIdentityToken,
-          inlineSessionPolicy,
-          managedSessionPolicies,
-        });
-      }, true);
+      const roleCredentials = await retryAndBackoff(
+        async () => {
+          return assumeRole({
+            credentialsClient,
+            sourceAccountId,
+            roleToAssume,
+            roleExternalId,
+            roleDuration,
+            roleSessionName,
+            roleSkipSessionTagging,
+            webIdentityTokenFile,
+            webIdentityToken,
+            inlineSessionPolicy,
+            managedSessionPolicies,
+          });
+        },
+        !disableRetry,
+        maxRetries
+      );
       core.info(`Authenticated as assumedRoleId ${roleCredentials.AssumedRoleUser!.AssumedRoleId!}`);
-      exportCredentials(roleCredentials.Credentials);
+      exportCredentials(roleCredentials.Credentials, outputCredentials);
       // We need to validate the credentials in 2 of our use-cases
       // First: self-hosted runners. If the GITHUB_ACTIONS environment variable
       //  is set to `true` then we are NOT in a self-hosted runner.