chore(main): release 4.2.1 (#1356)

fix: ensure explicit inputs take precedence over environment variables

.github/workflows/dependabot-autoapprove.yml

@@ -1,8 +1,12 @@
 name: Dependabot auto-approve
-on: pull_request
+on: 
+  pull_request:
+  workflow_dispatch:
+
 permissions:
   pull-requests: write
   id-token: write
+  contents: read
 jobs:
   dependabot:
     runs-on: ubuntu-latest
@@ -17,7 +21,7 @@ jobs:
         uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-region: us-west-2
-          role-to-assume: ${{ secrets.SECRETS_AWS_PACKAGING_ROLE_TO_ASSUME }}
+          role-to-assume: arn:aws:iam::206735643321:role/ConfigureAwsCredentialsPackageRole
           role-duration-seconds: 900
       - name: Get bot user token
         uses: aws-actions/aws-secretsmanager-get-secrets@v2

.release-please-manifest.json

@@ -1,5 +1,5 @@
 {
   ".release-please-manifest.json": "4.0.2",
   "package.json": "4.0.2",
-  ".": "4.1.0"
+  ".": "4.2.1"
 }

CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [4.2.1](https://github.com/aws-actions/configure-aws-credentials/compare/v4.2.0...v4.2.1) (2025-05-14)
+
+
+### Bug Fixes
+
+* ensure explicit inputs take precedence over environment variables ([e56e6c4](https://github.com/aws-actions/configure-aws-credentials/commit/e56e6c4038915cd5a7238a671fe97f44c98a40b0))
+* prioritize explicit inputs over environment variables ([df9c8fe](https://github.com/aws-actions/configure-aws-credentials/commit/df9c8fed6b364f0d1fb0e6e03a0ec26f1ea4e3fc))
+
+## [4.2.0](https://github.com/aws-actions/configure-aws-credentials/compare/v4.1.0...v4.2.0) (2025-05-06)
+
+
+### Features
+
+* add Expiration field to Outputs ([a4f3267](https://github.com/aws-actions/configure-aws-credentials/commit/a4f326760c1c1bf49ab86051c658d6501816b930))
+* Document role-duration-seconds range ([5a0cf01](https://github.com/aws-actions/configure-aws-credentials/commit/5a0cf0167f837dfa7af7d951ba6a78a38dc2b79e))
+* support action inputs as environment variables ([#1338](https://github.com/aws-actions/configure-aws-credentials/issues/1338)) ([2c168ad](https://github.com/aws-actions/configure-aws-credentials/commit/2c168adcae62d67531ba83842723c8f30695116a))
+
+
+### Bug Fixes
+
+* make sure action builds, also fix dependabot autoapprove ([c401b8a](https://github.com/aws-actions/configure-aws-credentials/commit/c401b8a98c5067672f52e0387cdd87d54acfe1fd))
+* role chaning on mulitple runs ([#1340](https://github.com/aws-actions/configure-aws-credentials/issues/1340)) ([9e38641](https://github.com/aws-actions/configure-aws-credentials/commit/9e386419117a9edd458297e4f1822a5df7506a03))
+
 ## [4.1.0](https://github.com/aws-actions/configure-aws-credentials/compare/v4.0.3...v4.1.0) (2025-02-08)
 
 

README.md

@@ -105,13 +105,13 @@ See [action.yml](./action.yml) for more detail.
 | audience                  | The JWT audience when using OIDC. Used in non-default AWS partitions, like China regions.         |    No    |
 | http-proxy                | An HTTP proxy to use for API calls.                                                               |    No    |
 | mask-aws-account-id       | AWS account IDs are not considered secret. Setting this will hide account IDs from output anyway. |    No    |
-| role-duration-seconds     | The assumed role duration in seconds, if assuming a role. Defaults to 1 hour.                     |    No    |
+| role-duration-seconds     | The assumed role duration in seconds, if assuming a role. Defaults to 1 hour (3600 seconds). Acceptable values range from 15 minutes (900 seconds) to 12 hours (43200 seconds). |    No    |
 | role-external-id          | The external ID of the role to assume. Only needed if your role requires it.                      |    No    |
 | role-session-name         | Defaults to "GitHubActions", but may be changed if required.                                      |    No    |
 | role-skip-session-tagging | Skips session tagging if set.                                                                     |    No    |
 | inline-session-policy     | You may further restrict the assumed role policy by defining an inline policy here.               |    No    |
 | managed-session-policies  | You may further restrict the assumed role policy by specifying a managed policy here.             |    No    |
-| output-credentials        | When set, outputs fetched credentials as action step output. Defaults to false.                   |    No    |
+| output-credentials        | When set, outputs fetched credentials as action step output. (Outputs access-key-id, secret-access-key, session-token, and expiration). Defaults to false.                   |    No    |
 | unset-current-credentials | When set, attempts to unset any existing credentials in your action runner.                       |    No    |
 | disable-retry             | Disabled retry/backoff logic for assume role calls. By default, retries are enabled.              |    No    |
 | retry-max-attempts        | Limits the number of retry attempts before giving up. Defaults to 12.                             |    No    |
@@ -131,7 +131,13 @@ with the `role-external-id` input
 
 #### Session tagging and name
 The default session name is "GitHubActions", and you can modify it by specifying
-the desired name in `role-session-name`. The session will be tagged with the
+the desired name in `role-session-name`.
+
+_Note: you might find it helpful to set the `role-session-name` to `${{ github.run_id }}` 
+so as to clarify in audit logs which AWS actions were performed by which workflow 
+run._
+
+The session will be tagged with the
 following tags: (Refer to [GitHub's documentation for `GITHUB_` environment
 variable definitions](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/using-environment-variables#default-environment-variables))
 
@@ -184,7 +190,7 @@ line like this:
 ```
 Or we can have a nicely formatted JSON as well:
 ```yaml
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@v4.1.0
       with:
          inline-session-policy: >-
           {
@@ -205,13 +211,13 @@ The Amazon Resource Names (ARNs) of the IAM managed policies that you want to
 use as managed session policies. The policies must exist in the same account as
 the role. You can pass a single managed policy like this:
 ```yaml
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@v4.1.0
       with:
          managed-session-policies: arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
 ```
 And we can pass multiple managed policies likes this:
 ```yaml
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@v4.1.0
       with:
          managed-session-policies: |
           arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
@@ -286,7 +292,7 @@ You can specify the audience through the `audience` input:
 
 ```yaml
     - name: Configure AWS Credentials for China region audience
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@v4.1.0
       with:
         audience: sts.amazonaws.com.cn
         aws-region: us-east-3
@@ -421,7 +427,7 @@ You can use this action to simply configure the region and account ID in the
 environment, and then use the runner's credentials for all AWS API calls made by
 your Actions workflow:
 ```yaml
-uses: aws-actions/configure-aws-credentials@v4
+uses: aws-actions/configure-aws-credentials@v4.1.0
 with:
   aws-region: us-east-2
 ```
@@ -431,7 +437,7 @@ APIs called by your Actions workflow.
 Or, you can use this action to assume a role, and then use the role credentials
 for all AWS API calls made by your Actions workflow:
 ```yaml
-uses: aws-actions/configure-aws-credentials@v4
+uses: aws-actions/configure-aws-credentials@v4.1.0
 with:
   aws-region: us-east-2
   role-to-assume: my-github-actions-role
@@ -453,7 +459,7 @@ variable.
 
 Manually configured proxy:
 ```yaml
-uses: aws-actions/configure-aws-credentials@v4
+uses: aws-actions/configure-aws-credentials@v4.1.0
 with:
   aws-region: us-east-2
   role-to-assume: my-github-actions-role
@@ -480,7 +486,7 @@ should include the AWS CLI by default.
 ### AssumeRoleWithWebIdentity (recommended)
 ```yaml
     - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@v4.1.0
       with:
         aws-region: us-east-2
         role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
@@ -494,13 +500,13 @@ environment variable and use it to assume the role
 ### AssumeRole with role previously assumed by action in same workflow
 ```yaml
     - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@v4.1.0
       with:
         aws-region: us-east-2
         role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
         role-session-name: MySessionName
     - name: Configure other AWS Credentials
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@v4.1.0
       with:
         aws-region: us-east-2
         role-to-assume: arn:aws:iam::987654321000:role/my-second-role
@@ -515,7 +521,7 @@ role, `arn:aws:iam::987654321000:role/my-second-role`.
 ### AssumeRole with static IAM credentials in repository secrets
 ```yaml
     - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@v4.1.0
       with:
         aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
         aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -534,7 +540,7 @@ name, like `role-to-assume: my-github-actions-role`.
 ```yaml
     - name: Configure AWS Credentials 1
       id: creds
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@v4.1.0
       with:
         aws-region: us-east-2
         role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
@@ -543,7 +549,7 @@ name, like `role-to-assume: my-github-actions-role`.
       run: |
         aws sts get-caller-identity
     - name: Configure AWS Credentials 2
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@v4.1.0
       with:
         aws-region: us-east-2
         aws-access-key-id: ${{ steps.creds.outputs.aws-access-key-id }}

dist/cleanup/CredentialsClient.d.ts

@@ -1,14 +0,0 @@
-import { STSClient } from '@aws-sdk/client-sts';
-export interface CredentialsClientProps {
-    region?: string;
-    proxyServer?: string;
-}
-export declare class CredentialsClient {
-    region?: string;
-    private _stsClient?;
-    private readonly requestHandler?;
-    constructor(props: CredentialsClientProps);
-    get stsClient(): STSClient;
-    validateCredentials(expectedAccessKeyId?: string, roleChaining?: boolean): Promise<void>;
-    private loadCredentials;
-}

dist/cleanup/assumeRole.d.ts

@@ -1,17 +0,0 @@
-import type { CredentialsClient } from './CredentialsClient';
-export interface assumeRoleParams {
-    credentialsClient: CredentialsClient;
-    roleToAssume: string;
-    roleDuration: number;
-    roleSessionName: string;
-    roleSkipSessionTagging?: boolean;
-    sourceAccountId?: string;
-    roleExternalId?: string;
-    webIdentityTokenFile?: string;
-    webIdentityToken?: string;
-    inlineSessionPolicy?: string;
-    managedSessionPolicies?: {
-        arn: string;
-    }[];
-}
-export declare function assumeRole(params: assumeRoleParams): Promise<import("@aws-sdk/client-sts").AssumeRoleCommandOutput>;

dist/cleanup/cleanup/index.d.ts

@@ -1,11 +0,0 @@
-/**
- * When the GitHub Actions job is done, clean up any environment variables that
- * may have been set by the configure-aws-credentials steps in the job.
- *
- * Environment variables are not intended to be shared across different jobs in
- * the same GitHub Actions workflow: GitHub Actions documentation states that
- * each job runs in a fresh instance.  However, doing our own cleanup will
- * give us additional assurance that these environment variables are not shared
- * with any other jobs.
- */
-export declare function cleanup(): void;

dist/cleanup/helpers.d.ts

@@ -1,17 +0,0 @@
-import type { Credentials } from '@aws-sdk/client-sts';
-import type { CredentialsClient } from './CredentialsClient';
-export declare function exportCredentials(creds?: Partial<Credentials>, outputCredentials?: boolean): void;
-export declare function unsetCredentials(): void;
-export declare function exportRegion(region: string): void;
-export declare function exportAccountId(credentialsClient: CredentialsClient, maskAccountId?: boolean): Promise<string>;
-export declare function sanitizeGitHubVariables(name: string): string;
-export declare function defaultSleep(ms: number): Promise<unknown>;
-declare let sleep: typeof defaultSleep;
-export declare function withsleep(s: typeof sleep): void;
-export declare function reset(): void;
-export declare function verifyKeys(creds: Partial<Credentials> | undefined): boolean;
-export declare function retryAndBackoff<T>(fn: () => Promise<T>, isRetryable: boolean, maxRetries?: number, retries?: number, base?: number): Promise<T>;
-export declare function errorMessage(error: unknown): string;
-export declare function isDefined<T>(i: T | undefined | null): i is T;
-export declare function areCredentialsValid(credentialsClient: CredentialsClient): Promise<boolean>;
-export {};

dist/cleanup/index.d.ts

@@ -1 +0,0 @@
-export declare function run(): Promise<void>;

dist/cleanup/src/CredentialsClient.d.ts

@@ -1,14 +0,0 @@
-import { STSClient } from '@aws-sdk/client-sts';
-export interface CredentialsClientProps {
-    region?: string;
-    proxyServer?: string;
-}
-export declare class CredentialsClient {
-    region?: string;
-    private _stsClient?;
-    private readonly requestHandler?;
-    constructor(props: CredentialsClientProps);
-    get stsClient(): STSClient;
-    validateCredentials(expectedAccessKeyId?: string, roleChaining?: boolean): Promise<void>;
-    private loadCredentials;
-}

dist/cleanup/src/assumeRole.d.ts

@@ -1,17 +0,0 @@
-import type { CredentialsClient } from './CredentialsClient';
-export interface assumeRoleParams {
-    credentialsClient: CredentialsClient;
-    roleToAssume: string;
-    roleDuration: number;
-    roleSessionName: string;
-    roleSkipSessionTagging?: boolean;
-    sourceAccountId?: string;
-    roleExternalId?: string;
-    webIdentityTokenFile?: string;
-    webIdentityToken?: string;
-    inlineSessionPolicy?: string;
-    managedSessionPolicies?: {
-        arn: string;
-    }[];
-}
-export declare function assumeRole(params: assumeRoleParams): Promise<import("@aws-sdk/client-sts").AssumeRoleCommandOutput>;

dist/cleanup/src/cleanup/index.d.ts

@@ -1,11 +0,0 @@
-/**
- * When the GitHub Actions job is done, clean up any environment variables that
- * may have been set by the configure-aws-credentials steps in the job.
- *
- * Environment variables are not intended to be shared across different jobs in
- * the same GitHub Actions workflow: GitHub Actions documentation states that
- * each job runs in a fresh instance.  However, doing our own cleanup will
- * give us additional assurance that these environment variables are not shared
- * with any other jobs.
- */
-export declare function cleanup(): void;

dist/cleanup/src/helpers.d.ts

@@ -1,16 +0,0 @@
-import type { Credentials } from '@aws-sdk/client-sts';
-import type { CredentialsClient } from './CredentialsClient';
-export declare function exportCredentials(creds?: Partial<Credentials>, outputCredentials?: boolean): void;
-export declare function unsetCredentials(): void;
-export declare function exportRegion(region: string): void;
-export declare function exportAccountId(credentialsClient: CredentialsClient, maskAccountId?: boolean): Promise<string>;
-export declare function sanitizeGitHubVariables(name: string): string;
-export declare function defaultSleep(ms: number): Promise<unknown>;
-declare let sleep: typeof defaultSleep;
-export declare function withsleep(s: typeof sleep): void;
-export declare function reset(): void;
-export declare function verifyKeys(creds: Partial<Credentials> | undefined): boolean;
-export declare function retryAndBackoff<T>(fn: () => Promise<T>, isRetryable: boolean, maxRetries?: number, retries?: number, base?: number): Promise<T>;
-export declare function errorMessage(error: unknown): string;
-export declare function isDefined<T>(i: T | undefined | null): i is T;
-export {};

dist/cleanup/src/index.d.ts

@@ -1 +0,0 @@
-export declare function run(): Promise<void>;

dist/cleanup/test/cleanup.test.d.ts

@@ -1 +0,0 @@
-export {};

dist/cleanup/test/helpers.test.d.ts

@@ -1 +0,0 @@
-export {};

dist/cleanup/test/index.test.d.ts

@@ -1 +0,0 @@
-export {};

dist/cleanup/test/mockinputs.test.d.ts

@@ -1,74 +0,0 @@
-import type * as core from '@actions/core';
-declare const _default: {
-    readonly outputs: {
-        STS_CREDENTIALS: {
-            Credentials: {
-                AccessKeyId: string;
-                SecretAccessKey: string;
-                SessionToken: string;
-                Expiration: Date;
-            };
-            AssumedRoleUser: {
-                Arn: string;
-                AssumedRoleId: string;
-            };
-        };
-        GET_CALLER_IDENTITY: {
-            Account: string;
-            Arn: string;
-        };
-        FAKE_STS_ACCESS_KEY_ID: string;
-        FAKE_STS_SECRET_ACCESS_KEY: string;
-        FAKE_STS_SESSION_TOKEN: string;
-        ODD_CHARACTER_CREDENTIALS: {
-            Credentials: {
-                AccessKeyId: string;
-                SecretAccessKey: string;
-                SessionToken: string;
-                Expiration: Date;
-            };
-            AssumedRoleUser: {
-                Arn: string;
-                AssumedRoleId: string;
-            };
-        };
-    };
-    readonly envs: {
-        GITHUB_REPOSITORY: string;
-        GITHUB_WORKFLOW: string;
-        GITHUB_ACTION: string;
-        GITHUB_ACTOR: string;
-        GITHUB_SHA: string;
-        GITHUB_WORKSPACE: string;
-        GITHUB_ACTIONS: string;
-    };
-    readonly GH_OIDC_INPUTS: {
-        'role-to-assume': string;
-        'aws-region': string;
-        'special-characters-workaround': string;
-    };
-    readonly IAM_USER_INPUTS: {
-        'aws-access-key-id': string;
-        'aws-secret-access-key': string;
-        'aws-region': string;
-    };
-    readonly IAM_ASSUMEROLE_INPUTS: {
-        'aws-access-key-id': string;
-        'aws-secret-access-key': string;
-        'role-to-assume': string;
-        'aws-region': string;
-    };
-    readonly WEBIDENTITY_TOKEN_FILE_INPUTS: {
-        'web-identity-token-file': string;
-        'role-to-assume': string;
-        'aws-region': string;
-    };
-    readonly EXISTING_ROLE_INPUTS: {
-        'role-to-assume': string;
-        'role-chaining': string;
-        'aws-region': string;
-    };
-    readonly getInput: (fakeEnv: Record<string, string>) => (name: string, options?: core.InputOptions) => string;
-    readonly getMultilineInput: (fakeEnv: Record<string, string[]>) => (name: string, options?: core.InputOptions) => string[];
-};
-export default _default;

package.json

@@ -1,12 +1,12 @@
 {
   "name": "configure-aws-credentials",
   "description": "A GitHub Action to configure AWS credentials",
-  "version": "4.1.0",
+  "version": "4.2.1",
   "scripts": {
     "build": "tsc",
     "lint": "biome check --error-on-warnings ./src",
     "package": "npm run build && ncc build --license THIRD-PARTY -o dist && ncc build src/cleanup/index.ts -o dist/cleanup && cpy dist/THIRD-PARTY . && del-cli dist/THIRD-PARTY",
-    "test": "npm run lint && vitest run"
+    "test": "npm run lint && vitest run && npm run build"
   },
   "author": {
     "name": "Amazon.com, Inc. or its affiliates",
@@ -14,24 +14,24 @@
     "organization": true
   },
   "devDependencies": {
-    "@aws-sdk/credential-provider-env": "^3.515.0",
+    "@aws-sdk/credential-provider-env": "^3.808.0",
     "@biomejs/biome": "1.9.4",
     "@smithy/property-provider": "^4.0.1",
-    "@types/node": "^22.13.1",
+    "@types/node": "^22.15.17",
     "@vercel/ncc": "^0.38.3",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^3.1.2",
     "aws-sdk-client-mock": "^4.1.0",
     "cpy-cli": "^5.0.0",
     "del-cli": "^6.0.0",
     "json-schema": "^0.4.0",
-    "memfs": "^4.17.0",
+    "memfs": "^4.17.1",
     "standard-version": "^9.5.0",
-    "typescript": "^5.7.3",
-    "vitest": "^2.1.9"
+    "typescript": "^5.8.3",
+    "vitest": "^3.1.2"
   },
   "dependencies": {
     "@actions/core": "^1.11.1",
-    "@aws-sdk/client-sts": "^3.741.0",
+    "@aws-sdk/client-sts": "^3.808.0",
     "@smithy/node-http-handler": "^4.0.1",
     "https-proxy-agent": "^5.0.1"
   },

src/helpers.ts

@@ -7,6 +7,36 @@ const MAX_TAG_VALUE_LENGTH = 256;
 const SANITIZATION_CHARACTER = '_';
 const SPECIAL_CHARS_REGEX = /[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?]+/;
 
+export function translateEnvVariables() {
+  const envVars = [
+    'AWS_REGION',
+    'ROLE_TO_ASSUME',
+    'WEB_IDENTITY_TOKEN_FILE',
+    'ROLE_CHAINING',
+    'AUDIENCE',
+    'HTTP_PROXY',
+    'MASK_AWS_ACCOUNT_ID',
+    'ROLE_DURATION_SECONDS',
+    'ROLE_EXTERNAL_ID',
+    'ROLE_SESSION_NAME',
+    'ROLE_SKIP_SESSION_TAGGING',
+    'INLINE_SESSION_POLICY',
+    'MANAGED_SESSION_POLICIES',
+    'OUTPUT_CREDENTIALS',
+    'UNSET_CURRENT_CREDENTIALS',
+    'DISABLE_RETRY',
+    'RETRY_MAX_ATTEMPTS',
+    'SPECIAL_CHARACTERS_WORKAROUND',
+    'USE_EXISTING_CREDENTIALS',
+  ];
+  for (const envVar of envVars) {
+    if (process.env[envVar]) {
+      const inputKey = `INPUT_${envVar.replace(/_/g, '-')}`;
+      process.env[inputKey] = process.env[inputKey] || process.env[envVar];
+    }
+  }
+}
+
 // Configure the AWS CLI and AWS SDKs using environment variables and set them as secrets.
 // Setting the credentials as secrets masks them in Github Actions logs
 export function exportCredentials(creds?: Partial<Credentials>, outputCredentials?: boolean) {
@@ -38,6 +68,9 @@ export function exportCredentials(creds?: Partial<Credentials>, outputCredential
     if (creds?.SessionToken) {
       core.setOutput('aws-session-token', creds.SessionToken);
     }
+    if (creds?.Expiration) {
+      core.setOutput('aws-expiration', creds.Expiration);
+    }
   }
 }
 

src/index.ts

@@ -9,6 +9,7 @@ import {
   exportCredentials,
   exportRegion,
   retryAndBackoff,
+  translateEnvVariables,
   unsetCredentials,
   verifyKeys,
 } from './helpers';
@@ -19,6 +20,7 @@ const REGION_REGEX = /^[a-z0-9-]+$/g;
 
 export async function run() {
   try {
+    translateEnvVariables();
     // Get inputs
     const AccessKeyId = core.getInput('aws-access-key-id', { required: false });
     const SecretAccessKey = core.getInput('aws-secret-access-key', {

test/helpers.test.ts

@@ -27,8 +27,8 @@ describe('Configure AWS Credentials helpers', {}, () => {
     vi.spyOn(core, 'setOutput').mockImplementation(() => {});
     vi.spyOn(core, 'setSecret').mockImplementation(() => {});
     vi.spyOn(core, 'exportVariable').mockImplementation(() => {});
-    helpers.exportCredentials({ AccessKeyId: 'test', SecretAccessKey: 'test', SessionToken: 'test' }, true);
-    expect(core.setOutput).toHaveBeenCalledTimes(3);
+    helpers.exportCredentials({ AccessKeyId: 'test', SecretAccessKey: 'test', SessionToken: 'test', Expiration: new Date(8640000000000000) }, true);
+    expect(core.setOutput).toHaveBeenCalledTimes(4);
     expect(core.setSecret).toHaveBeenCalledTimes(3);
     expect(core.exportVariable).toHaveBeenCalledTimes(3);
   });

tsconfig.json

@@ -13,7 +13,7 @@
     "module": "CommonJS",
     "resolveJsonModule": true,
     "outDir": "build",
-    "declaration": true,
+    "declaration": false,
     "newLine": "lf",
     "noEmitOnError": true,
     "sourceMap": true,