feat: Add a `skip_token_revoke` input for configuring token revocation #54

smockle · 2023-10-03T17:29:59Z

Fixes #55

Currently, actions/create-github-app-token always/unconditionally revokes the installation access token in a post step, at the completion of the current job. This prevents tokens from being used in other jobs.

This PR makes this behavior configurable:

When the skip-token-revoke input is not specified (i.e. by default), the token is revoked in a post step (i.e. the current behavior).
When the skip-token-revoke input is set to a truthy value (e.g. "true"¹), the token is not revoked in a post step.

This PR adds a test for the skip-token-revoke: "true" case.

This is configurable in other app token actions, e.g. tibdex/github-app-token and wow-actions/use-app-token.

Note that "false" is also truthy: Boolean("false") is true. If we think that’ll potentially confuse folks, I can require skip-token-revoke to be set explicitly to "true". ↩

gr2m · 2023-10-03T17:33:38Z

I've seen this option but couldn't think of a use case for it. Do you know why it was added to tibdex/github-app-token or can you think of a use case when someone would need it?

No biggie but could you create an issue next time before putting in work into a pull request? That way we can have a discussion and avoid unnecessary work

smockle · 2023-10-03T18:14:19Z

I've seen this option but couldn't think of a use case for it…can you think of a use case when someone would need it?

No biggie but could you create an issue next time before putting in work into a pull request? That way we can have a discussion and avoid unnecessary work

@gr2m I opened #55, and I wrote about our use case there. Let’s move discussion there.

gr2m · 2023-10-03T18:26:37Z

README.md

+### `revoke`
+
+**Optional:** Whether to revoke the token when the current job is complete. Default: `"true"`.


I wonder if revoke is the best possible argument for this feature. As the default is true. I think it might be more elegant to have an option that is not set by default at all, and needs to be set to overwrite it.

For example: do_not_revoke_token_after_job. Long but clear 🤷🏼

or skip_token_revoke

I wondered the same thing! Either of those suggestions works for me.

The 5 actions I surveyed in https://github.com/github/core-ux/discussions/142#discussioncomment-7177238 (only accessible to Hubbers) (under “comparative analysis…”) didn’t reveal a widely-used name, but I’ll review the actions listed in #42 too.

actually I think we should use dashes for our arguments, it seems to be the convention for actions/* actions, e.g. see https://github.com/actions/checkout/. So we would do skip-token-revoke

@gr2m The existing inputs use underscores—would we want to migrate those to dashes too?

tibdex/github-app-token — Configurable with revoke. Default: Doesn’t revoke token.

It looks like this is a new feature for that action. The documentation isn't very clear about this, but it looks like the value of revoke is actually true by default.

I'm in favor of using revoke in the same way (as you did originally), but I don't feel strongly about it, so I'll leave it up to @gr2m.

okay let's go with skip_token_revoke, let's have a separate discussion about whether to migrate arguments to dashes. I'd rather change it now when adaption is still early

Sounds good! Just throwing out one more possible alternative name: do_not_revoke.

Take it or leave it; I don't feel strongly about this one either. 😄

…let's have a separate discussion about whether to migrate arguments to dashes…

Opened #57 for this! 👍

…let's go with skip_token_revoke…

Done, via 5a2e1e7.

gr2m

great PR, thank you for bearing with us 💐

# [1.4.0](v1.3.0...v1.4.0) (2023-10-06) ### Features * Add a `skip_token_revoke` input for configuring token revocation ([#54](#54)) ([9ec88c4](9ec88c4)), closes [1#L46-L47](https://github.com/1/issues/L46-L47) [1#L132](https://github.com/1/issues/L132)

create-app-token-action-releaser · 2023-10-06T16:11:34Z

🎉 This PR is included in version 1.4.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

smockle requested review from gr2m, parkerbxyz and a team as code owners October 3, 2023 17:29

smockle mentioned this pull request Oct 3, 2023

Support opting-out of token revocation #55

Closed

gr2m reviewed Oct 3, 2023

View reviewed changes

smockle added 4 commits October 5, 2023 11:59

feat: Add a 'revoke' input for configuring token revocation

53ce0ba

chore: Run 'npm run build'

0097d3d

fix: Rename input, from 'revoke' to 'skip-token-revoke'

30a43c8

chore: Re-run 'npm run build' after rebasing

02443a1

smockle mentioned this pull request Oct 5, 2023

Proposal: Use dashes (instead of underscores) in input names #57

Closed

smockle changed the title ~~feat: Add a revoke input for configuring token revocation~~ feat: Add a skip_token_revoke input for configuring token revocation Oct 5, 2023

fix: Rename input, from 'skip-token-revoke' to 'skip_token_revoke'

5a2e1e7

gr2m approved these changes Oct 6, 2023

View reviewed changes

gr2m merged commit 9ec88c4 into actions:main Oct 6, 2023
2 checks passed

create-app-token-action-releaser bot added the released label Oct 6, 2023

smockle deleted the revoke branch October 6, 2023 16:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Add a `skip_token_revoke` input for configuring token revocation #54

feat: Add a `skip_token_revoke` input for configuring token revocation #54

smockle commented Oct 3, 2023 •

edited

Loading

gr2m commented Oct 3, 2023

smockle commented Oct 3, 2023

gr2m Oct 3, 2023

gr2m Oct 3, 2023

smockle Oct 3, 2023 •

edited

Loading

gr2m Oct 3, 2023

smockle Oct 3, 2023

parkerbxyz Oct 5, 2023 •

edited

Loading

gr2m Oct 5, 2023

parkerbxyz Oct 5, 2023 •

edited

Loading

smockle Oct 5, 2023 •

edited

Loading

smockle Oct 5, 2023

gr2m left a comment

create-app-token-action-releaser bot commented Oct 6, 2023

		### `revoke`

		Optional: Whether to revoke the token when the current job is complete. Default: `"true"`.

feat: Add a skip_token_revoke input for configuring token revocation #54

feat: Add a skip_token_revoke input for configuring token revocation #54

Conversation

smockle commented Oct 3, 2023 • edited Loading

Footnotes

gr2m commented Oct 3, 2023

smockle commented Oct 3, 2023

gr2m Oct 3, 2023

Choose a reason for hiding this comment

gr2m Oct 3, 2023

Choose a reason for hiding this comment

smockle Oct 3, 2023 • edited Loading

Choose a reason for hiding this comment

gr2m Oct 3, 2023

Choose a reason for hiding this comment

smockle Oct 3, 2023

Choose a reason for hiding this comment

parkerbxyz Oct 5, 2023 • edited Loading

Choose a reason for hiding this comment

gr2m Oct 5, 2023

Choose a reason for hiding this comment

parkerbxyz Oct 5, 2023 • edited Loading

Choose a reason for hiding this comment

smockle Oct 5, 2023 • edited Loading

Choose a reason for hiding this comment

smockle Oct 5, 2023

Choose a reason for hiding this comment

gr2m left a comment

Choose a reason for hiding this comment

create-app-token-action-releaser bot commented Oct 6, 2023

feat: Add a `skip_token_revoke` input for configuring token revocation #54

feat: Add a `skip_token_revoke` input for configuring token revocation #54

smockle commented Oct 3, 2023 •

edited

Loading

smockle Oct 3, 2023 •

edited

Loading

parkerbxyz Oct 5, 2023 •

edited

Loading

parkerbxyz Oct 5, 2023 •

edited

Loading

smockle Oct 5, 2023 •

edited

Loading