aws-actions/configure-aws-credentials
1
0
Fork 0
mirror of https://github.com/aws-actions/configure-aws-credentials.git synced 2026-09-01 05:45:06 +09:00
Code Issues Packages Projects Releases Wiki Activity

chore!: set linters to maximum strictness

Browse Source
This commit is contained in:
Tom Keller
2022-10-27 21:16:31 -07:00
parent 0240c3dd03
commit f698871603
12 changed files with 202 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/assumeRole.ts
+10 -7
View File
@@ -2,7 +2,8 @@ import assert from 'assert';
import fs from 'fs';
import path from 'path';
import * as core from '@actions/core';
import { AssumeRoleCommand, AssumeRoleCommandInput, AssumeRoleWithWebIdentityCommand } from '@aws-sdk/client-sts';
import type { AssumeRoleCommandInput, Tag } from '@aws-sdk/client-sts';
import { AssumeRoleCommand, AssumeRoleWithWebIdentityCommand } from '@aws-sdk/client-sts';
import { errorMessage, getStsClient, isDefined } from './helpers';
const SANITIZATION_CHARACTER = '_';
@@ -64,7 +65,7 @@ export async function assumeRole(params: assumeRoleParams) {
RoleArn = `arn:aws:iam::${sourceAccountId}:role/${RoleArn}`;
}
const tagArray = [
const tagArray: Tag[] = [
{ Key: 'GitHub', Value: 'Actions' },
{ Key: 'Repository', Value: GITHUB_REPOSITORY },
{ Key: 'Workflow', Value: sanitizeGithubWorkflowName(GITHUB_WORKFLOW) },
@@ -73,23 +74,25 @@ export async function assumeRole(params: assumeRoleParams) {
{ Key: 'Commit', Value: GITHUB_SHA },
];
if (process.env.GITHUB_REF) {
tagArray.push({ Key: 'Branch', Value: process.env.GITHUB_REF });
if (process.env['GITHUB_REF']) {
tagArray.push({ Key: 'Branch', Value: process.env['GITHUB_REF'] });
}
const Tags = roleSkipSessionTagging ? undefined : tagArray;
if (!Tags) {
core.debug('Role session tagging has been skipped.');
} else {
core.debug(Tags.length + ' role session tags are being used.');
core.debug(`${Tags.length} role session tags are being used.`);
}
const ExternalId = roleExternalId;
const commonAssumeRoleParams: AssumeRoleCommandInput = {
RoleArn,
RoleSessionName: roleSessionName,
DurationSeconds: roleDurationSeconds,
Tags,
ExternalId: roleExternalId,
...(Tags ? { Tags } : {}),
...(ExternalId ? { ExternalId } : {}),
};
const keys = Object.keys(commonAssumeRoleParams) as Array<keyof typeof commonAssumeRoleParams>;
keys.forEach((k) => commonAssumeRoleParams[k] === undefined && delete commonAssumeRoleParams[k]);
src/cleanup/index.ts
+5 -5
View File
@@ -12,7 +12,7 @@ import { errorMessage } from '../helpers';
* with any other jobs.
*/
export async function cleanup() {
export function cleanup() {
try {
// The GitHub Actions toolkit does not have an option to completely unset
// environment variables, so we overwrite the current value with an empty
@@ -29,9 +29,9 @@ export async function cleanup() {
}
/* c8 ignore start */
if (require.main === module) {
(async () => {
await cleanup();
})().catch((error) => {
try {
cleanup();
} catch (error) {
core.setFailed(errorMessage(error));
});
}
}
src/helpers.ts
+3 -3
View File
@@ -5,11 +5,11 @@ const SANITIZATION_CHARACTER = '_';
let stsclient: STSClient | undefined;
export function getStsClient(region: string, agent?: string) {
export function getStsClient(region: string, customUserAgent?: string) {
if (!stsclient) {
stsclient = new STSClient({
region,
customUserAgent: agent,
...(customUserAgent ? { customUserAgent } : {}),
});
}
return stsclient;
@@ -39,7 +39,7 @@ export function isDefined<T>(i: T | undefined | null): i is T {
}
/* c8 ignore stop */
export function defaultSleep(ms: number) {
export async function defaultSleep(ms: number) {
return new Promise((resolve) => setTimeout(resolve, ms));
}
let sleep = defaultSleep;
src/index.ts
+12 -10
View File
@@ -1,5 +1,6 @@
import * as core from '@actions/core';
import { Credentials, GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';
import type { Credentials } from '@aws-sdk/client-sts';
import { GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';
import { assumeRole } from './assumeRole';
import { errorMessage, getStsClient, retryAndBackoff } from './helpers';
@@ -35,7 +36,7 @@ function exportCredentials(creds?: Partial<Credentials>) {
if (creds?.SessionToken) {
core.setSecret(creds.SessionToken);
core.exportVariable('AWS_SESSION_TOKEN', creds.SessionToken);
} else if (process.env.AWS_SESSION_TOKEN) {
} else if (process.env['AWS_SESSION_TOKEN']) {
// clear session token from previous credentials action
core.exportVariable('AWS_SESSION_TOKEN', '');
}
@@ -104,7 +105,8 @@ export async function run() {
const audience = core.getInput('audience', { required: false });
const SecretAccessKey = core.getInput('aws-secret-access-key', { required: false });
const region = core.getInput('aws-region', { required: true });
const SessionToken = core.getInput('aws-session-token', { required: false });
const sessionTokenInput = core.getInput('aws-session-token', { required: false });
const SessionToken = sessionTokenInput === '' ? undefined : sessionTokenInput;
const maskAccountId =
(core.getInput('mask-aws-account-id', { required: false }) || 'true').toLowerCase() === 'true';
const roleToAssume = core.getInput('role-to-assume', { required: false });
@@ -113,11 +115,11 @@ export async function run() {
// This wraps the logic for deciding if we should rely on the GH OIDC provider since we may need to reference
// the decision in a few differennt places. Consolidating it here makes the logic clearer elsewhere.
const useGitHubOIDCProvider =
!!roleToAssume && !!process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN && !AccessKeyId && !webIdentityTokenFile;
!!roleToAssume && !!process.env['ACTIONS_ID_TOKEN_REQUEST_TOKEN'] && !AccessKeyId && !webIdentityTokenFile;
const roleDurationSeconds =
parseInt(core.getInput('role-duration-seconds', { required: false })) ||
(SessionToken && SESSION_ROLE_DURATION) ||
(useGitHubOIDCProvider && DEFAULT_ROLE_DURATION_FOR_OIDC_ROLES) ||
(parseInt(core.getInput('role-duration-seconds', { required: false })) ||
((SessionToken ? SESSION_ROLE_DURATION : undefined) ??
(useGitHubOIDCProvider ? DEFAULT_ROLE_DURATION_FOR_OIDC_ROLES : undefined))) ??
MAX_ACTION_RUNTIME;
const roleSessionName = core.getInput('role-session-name', { required: false }) || ROLE_SESSION_NAME;
const roleSkipSessionTaggingInput = core.getInput('role-skip-session-tagging', { required: false }) || 'false';
@@ -181,7 +183,7 @@ export async function run() {
// First: self-hosted runners. If the GITHUB_ACTIONS environment variable
// is set to `true` then we are NOT in a self-hosted runner.
// Second: Customer provided credentials manually (IAM User keys stored in GH Secrets)
if (!process.env.GITHUB_ACTIONS || AccessKeyId) {
if (!process.env['GITHUB_ACTIONS'] || AccessKeyId) {
await validateCredentials(roleCredentials.Credentials?.AccessKeyId);
}
await exportAccountId(region, maskAccountId);
@@ -189,7 +191,7 @@ export async function run() {
} catch (error) {
core.setFailed(errorMessage(error));
const showStackTrace = process.env.SHOW_STACK_TRACE;
const showStackTrace = process.env['SHOW_STACK_TRACE'];
if (showStackTrace === 'true') {
throw error;
@@ -202,6 +204,6 @@ if (require.main === module) {
(async () => {
await run();
})().catch((error) => {
core.setFailed(error.message);
core.setFailed(errorMessage(error));
});
}