Support opting-out of token revocation #55
Comments
|
Thanks for sharing the use case, makes totally sense! |
gr2m
pushed a commit
that referenced
this issue
Oct 6, 2023
#54) Fixes #55 Currently, `actions/create-github-app-token` always/unconditionally revokes the installation access token in a `post` step, at the completion of the current job. This prevents tokens from being used in other jobs. This PR makes this behavior configurable: - When the `skip-token-revoke` input is not specified (i.e. by default), the token is revoked in a `post` step (i.e. the current behavior). - When the `skip-token-revoke` input is set to a truthy value (e.g. `"true"`[^1]), the token is not revoked in a `post` step. This PR adds a test for the `skip-token-revoke: "true"` case. This is configurable in other app token actions, e.g. [tibdex/github-app-token](https://github.com/tibdex/github-app-token/blob/3eb77c7243b85c65e84acfa93fdbac02fb6bd532/README.md?plain=1#L46-L47) and [wow-actions/use-app-token](https://github.com/wow-actions/use-app-token/blob/cd772994fc762f99cf291f308797341327a49b0c/README.md?plain=1#L132). [^1]: Note that `"false"` is also truthy: `Boolean("false")` is `true`. If we think that’ll potentially confuse folks, I can require `skip-token-revoke` to be set explicitly to `"true"`.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Relates to #54
Current behavior
From #54:
Use case
My team runs workflows that retrieve tokens for multiple hosts and multiple orgs.
As detailed in https://github.com/github/accessibility/discussions/4438 (only accessible to Hubbers), we use environment secrets to keep secrets (e.g. app id, installation id, and private key) organized.
Since individual steps cannot access an arbitrary environment’s secrets (i.e. there is no
jobs.<job_id>.steps[*].environment), we use multiple jobs, one job per environment.After we obtain a token using a given environment’s secrets, it’s encrypted and then made available to a subsequent job. However, if the token is revoked at the completion of the job that retrieves it, then the next job can’t use it.
Proposed behavior
actions/create-github-app-tokenshould support opting-out of revocation. This could be accomplished by introducing a new input, e.g.revoke: ("true"|"false"), as in #54.The text was updated successfully, but these errors were encountered: