Don't set GITHUB_TOKEN env variable

pkg/runner/run_context.go

@@ -97,23 +97,23 @@
 	if rc.Config.ContainerNetworkMode == "" {
 		return "host", false
 	}
 	return string(rc.Config.ContainerNetworkMode), false
 }
 
 func getDockerDaemonSocketMountPath(daemonPath string) string {
 	if protoIndex := strings.Index(daemonPath, "://"); protoIndex != -1 {
 		scheme := daemonPath[:protoIndex]
 		if strings.EqualFold(scheme, "npipe") {
 			// linux container mount on windows, use the default socket path of the VM / wsl2
 			return "/var/run/docker.sock"
 		} else if strings.EqualFold(scheme, "unix") {
 			return daemonPath[protoIndex+3:]
 		} else if strings.IndexFunc(scheme, func(r rune) bool {
 			return (r < 'a' || r > 'z') && (r < 'A' || r > 'Z')
 		}) == -1 {
 			// unknown protocol use default
 			return "/var/run/docker.sock"
 		}
 	}
 	return daemonPath
 }
@@ -291,14 +291,14 @@
 			}
 			username, password, err = rc.handleServiceCredentials(ctx, spec.Credentials)
 			if err != nil {
 				return fmt.Errorf("failed to handle service %s credentials: %w", serviceID, err)
 			}
 			serviceBinds, serviceMounts := rc.GetServiceBindsAndMounts(spec.Volumes)
 
 			exposedPorts, portBindings, err := nat.ParsePortSpecs(spec.Ports)
 			if err != nil {
 				return fmt.Errorf("failed to parse service %s ports: %w", serviceID, err)
 			}
 
 			serviceContainerName := createContainerName(rc.jobContainerName(), serviceID)
 			c := container.NewContainer(&container.NewContainerInput{
@@ -337,8 +337,8 @@
 						if len(rc.ServiceContainers) > 0 {
 							logger.Infof("Cleaning up services for job %s", rc.JobName)
 							if err := rc.stopServiceContainers()(ctx); err != nil {
 								logger.Errorf("Error while cleaning services: %v", err)
 							}
 							if createAndDeleteNetwork {
 								// clean network if it has been created by act
 								// if using service containers
@@ -346,8 +346,8 @@
 								// so, we should remove the network at last.
 								logger.Infof("Cleaning up network for job %s, and network name is: %s", rc.JobName, networkName)
 								if err := container.NewDockerNetworkRemoveExecutor(networkName)(ctx); err != nil {
 									logger.Errorf("Error while cleaning network: %v", err)
 								}
 							}
 						}
 						return nil
@@ -418,11 +418,11 @@
 	if rc.ExtraPath != nil && len(rc.ExtraPath) > 0 {
 		path := rc.JobContainer.GetPathVariableName()
 		if rc.JobContainer.IsEnvironmentCaseInsensitive() {
 			// On windows system Path and PATH could also be in the map
 			for k := range *env {
 				if strings.EqualFold(path, k) {
 					path = k
 					break
 				}
 			}
 		}
@@ -435,8 +435,8 @@
 				}
 			}
 			if len(cpath) == 0 {
 				cpath = rc.JobContainer.DefaultPathVariable()
 			}
 			(*env)[path] = cpath
 		}
 		(*env)[path] = rc.JobContainer.JoinPathVariable(append(rc.ExtraPath, (*env)[path])...)
@@ -517,16 +517,16 @@
 // ActionCacheDir is for rc
 func (rc *RunContext) ActionCacheDir() string {
 	if rc.Config.ActionCacheDir != "" {
 		return rc.Config.ActionCacheDir
 	}
 	var xdgCache string
 	var ok bool
 	if xdgCache, ok = os.LookupEnv("XDG_CACHE_HOME"); !ok || xdgCache == "" {
 		if home, err := os.UserHomeDir(); err == nil {
 			xdgCache = filepath.Join(home, ".cache")
 		} else if xdgCache, err = filepath.Abs("."); err != nil {
 			// It's almost impossible to get here, so the temp dir is a good fallback
 			xdgCache = os.TempDir()
 		}
 	}
 	return filepath.Join(xdgCache, "act")
@@ -598,8 +598,8 @@
 		executor = newLocalReusableWorkflowExecutor(rc)
 	case model.JobTypeReusableWorkflowRemote:
 		executor = newRemoteReusableWorkflowExecutor(rc)
 	case model.JobTypeInvalid:
 		return nil, err
 	}
 
 	return func(ctx context.Context) error {
@@ -677,11 +677,11 @@
 	jobType, jobTypeErr := job.Type()
 
 	if runJobErr != nil {
 		return false, fmt.Errorf("  \u274C  Error in if-expression: \"if: %s\" (%s)", job.If.Value, runJobErr)
 	}
 
 	if jobType == model.JobTypeInvalid {
 		return false, jobTypeErr
 	} else if jobType != model.JobTypeDefault {
 		return true, nil
 	}
@@ -837,13 +837,13 @@
 	}
 	// allow to be overridden by user
 	if rc.Config.Env["GITHUB_SERVER_URL"] != "" {
 		ghc.ServerURL = rc.Config.Env["GITHUB_SERVER_URL"]
 	}
 	if rc.Config.Env["GITHUB_API_URL"] != "" {
 		ghc.APIURL = rc.Config.Env["GITHUB_API_URL"]
 	}
 	if rc.Config.Env["GITHUB_GRAPHQL_URL"] != "" {
 		ghc.GraphQLURL = rc.Config.Env["GITHUB_GRAPHQL_URL"]
 	}
 
 	return ghc
@@ -911,7 +911,6 @@
 	env["GITHUB_REF"] = github.Ref
 	env["GITHUB_REF_NAME"] = github.RefName
 	env["GITHUB_REF_TYPE"] = github.RefType
-	env["GITHUB_TOKEN"] = github.Token
 	env["GITHUB_JOB"] = github.Job
 	env["GITHUB_REPOSITORY_OWNER"] = github.RepositoryOwner
 	env["GITHUB_RETENTION_DAYS"] = github.RetentionDays
@@ -945,7 +944,7 @@
 func setActionRuntimeVars(rc *RunContext, env map[string]string) {
 	actionsRuntimeURL := os.Getenv("ACTIONS_RUNTIME_URL")
 	if actionsRuntimeURL == "" {
 		actionsRuntimeURL = fmt.Sprintf("http://%s:%s/", rc.Config.ArtifactServerAddr, rc.Config.ArtifactServerPort)
 	}
 	env["ACTIONS_RUNTIME_URL"] = actionsRuntimeURL
 
@@ -967,14 +966,14 @@
 	}
 
 	if container.Credentials != nil && len(container.Credentials) != 2 {
 		err := fmt.Errorf("invalid property count for key 'credentials:'")
 		return "", "", err
 	}
 
 	ee := rc.NewExpressionEvaluator(ctx)
 	if username = ee.Interpolate(ctx, container.Credentials["username"]); username == "" {
 		err := fmt.Errorf("failed to interpolate container.credentials.username")
 		return "", "", err
 	}
 	if password = ee.Interpolate(ctx, container.Credentials["password"]); password == "" {
 		err := fmt.Errorf("failed to interpolate container.credentials.password")
@@ -982,41 +981,41 @@
 	}
 
 	if container.Credentials["username"] == "" || container.Credentials["password"] == "" {
 		err := fmt.Errorf("container.credentials cannot be empty")
 		return "", "", err
 	}
 
 	return username, password, nil
 }
 
 func (rc *RunContext) handleServiceCredentials(ctx context.Context, creds map[string]string) (username, password string, err error) {
 	if creds == nil {
 		return
 	}
 	if len(creds) != 2 {
 		err = fmt.Errorf("invalid property count for key 'credentials:'")
 		return
 	}
 
 	ee := rc.NewExpressionEvaluator(ctx)
 	if username = ee.Interpolate(ctx, creds["username"]); username == "" {
 		err = fmt.Errorf("failed to interpolate credentials.username")
 		return
 	}
 
 	if password = ee.Interpolate(ctx, creds["password"]); password == "" {
 		err = fmt.Errorf("failed to interpolate credentials.password")
 		return
 	}
 
 	return
 }
 
 // GetServiceBindsAndMounts returns the binds and mounts for the service container, resolving paths as appopriate
 func (rc *RunContext) GetServiceBindsAndMounts(svcVolumes []string) ([]string, map[string]string) {
 	if rc.Config.ContainerDaemonSocket == "" {
 		rc.Config.ContainerDaemonSocket = "/var/run/docker.sock"
 	}
 	binds := []string{}
 	if rc.Config.ContainerDaemonSocket != "-" {
 		daemonPath := getDockerDaemonSocketMountPath(rc.Config.ContainerDaemonSocket)
@@ -1026,14 +1025,14 @@
 	mounts := map[string]string{}
 
 	for _, v := range svcVolumes {
 		if !strings.Contains(v, ":") || filepath.IsAbs(v) {
 			// Bind anonymous volume or host file.
 			binds = append(binds, v)
 		} else {
 			// Mount existing volume.
 			paths := strings.SplitN(v, ":", 2)
 			mounts[paths[0]] = paths[1]
 		}
 	}
 
 	return binds, mounts

pkg/runner/step_test.go

@@ -182,7 +182,6 @@ func TestSetupEnv(t *testing.T) {
 		"GITHUB_RUN_ID":            "runId",
 		"GITHUB_RUN_NUMBER":        "1",
 		"GITHUB_SERVER_URL":        "https://",
-		"GITHUB_TOKEN":             "",
 		"GITHUB_WORKFLOW":          "",
 		"INPUT_STEP_WITH":          "with-value",
 		"RC_KEY":                   "rcvalue",