Skip to content

Commit 009fee2

Browse files
vaindvaind
committed
refactor: Split authentication validation into separate steps
Changes: - Step 1: Validate authentication inputs (checks at least one is present) - Step 2: Validate API token (runs only if token provided) - Step 3: Validate SSH key (runs only if SSH key provided) Benefits: - Clearer separation of concerns - Easier to read and maintain - Each validation only runs when relevant - SSH key validation now checks format
1 parent 6835015 commit 009fee2

File tree

1 file changed

+82
-48
lines changed

1 file changed

+82
-48
lines changed

‎updater/action.yml‎

Lines changed: 82 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ runs:
122122
}
123123
Write-Output "✓ Post-update script path '${{ inputs.post-update-script }}' is valid"
124124
125-
- name: Validate authentication
125+
- name: Validate authentication inputs
126126
shell: pwsh
127127
env:
128128
GH_TOKEN: ${{ inputs.api-token }}
@@ -136,68 +136,102 @@ runs:
136136
exit 1
137137
}
138138
139-
if ($hasToken -and $env:GH_TOKEN -match '-----BEGIN') {
139+
if ($hasToken -and $hasSshKey) {
140+
Write-Output "✓ Using both SSH key (for git) and token (for GitHub API)"
141+
} elseif ($hasToken) {
142+
Write-Output "✓ Using token authentication"
143+
} else {
144+
Write-Output "✓ Using SSH key authentication"
145+
}
146+
147+
- name: Validate API token
148+
if: ${{ inputs.api-token != '' }}
149+
shell: pwsh
150+
env:
151+
GH_TOKEN: ${{ inputs.api-token }}
152+
run: |
153+
# Check if token is actually an SSH key
154+
if ($env:GH_TOKEN -match '-----BEGIN') {
140155
Write-Output "::error::The api-token input appears to contain an SSH private key."
141156
Write-Output "::error::Please use the ssh-key input for SSH authentication instead of api-token."
142157
exit 1
143158
}
144159
145-
if ($hasToken -and $hasSshKey) {
146-
Write-Output "Using both SSH key (for git) and token (for GitHub API)"
160+
# Check for whitespace
161+
if ($env:GH_TOKEN -match '\s') {
162+
$tokenLength = $env:GH_TOKEN.Length
163+
$whitespaceMatch = [regex]::Match($env:GH_TOKEN, '\s')
164+
$position = $whitespaceMatch.Index
165+
$char = $whitespaceMatch.Value
166+
$charName = switch ($char) {
167+
"`n" { "newline (LF)" }
168+
"`r" { "carriage return (CR)" }
169+
"`t" { "tab" }
170+
" " { "space" }
171+
default { "whitespace character (code: $([int][char]$char))" }
172+
}
173+
Write-Output "::error::GitHub token contains whitespace at position $position of $tokenLength characters: $charName"
174+
Write-Output "::error::This suggests the token secret may be malformed. Check for extra newlines when setting the secret."
175+
exit 1
147176
}
148177
149-
# Token-specific validation
150-
if ($hasToken) {
151-
if ($env:GH_TOKEN -match '\s') {
152-
$tokenLength = $env:GH_TOKEN.Length
153-
$whitespaceMatch = [regex]::Match($env:GH_TOKEN, '\s')
154-
$position = $whitespaceMatch.Index
155-
$char = $whitespaceMatch.Value
156-
$charName = switch ($char) {
157-
"`n" { "newline (LF)" }
158-
"`r" { "carriage return (CR)" }
159-
"`t" { "tab" }
160-
" " { "space" }
161-
default { "whitespace character (code: $([int][char]$char))" }
178+
# Check token scopes (works for classic PATs only)
179+
$headers = curl -sS -I -H "Authorization: token $env:GH_TOKEN" https://api.github.com 2>&1
180+
$scopeLine = $headers | Select-String -Pattern '^x-oauth-scopes:' -CaseSensitive:$false
181+
if ($scopeLine) {
182+
$scopes = $scopeLine -replace '^x-oauth-scopes:\s*', '' -replace '\r', ''
183+
if ([string]::IsNullOrWhiteSpace($scopes)) {
184+
Write-Output "::warning::Token has no scopes. If using a fine-grained PAT, ensure it has Contents (write) and Pull Requests (write) permissions."
185+
} else {
186+
Write-Output "Token scopes: $scopes"
187+
if ($scopes -notmatch '\brepo\b' -and $scopes -notmatch '\bpublic_repo\b') {
188+
Write-Output "::warning::Token may be missing 'repo' or 'public_repo' scope. This may cause issues with private repositories."
162189
}
163-
Write-Output "::error::GitHub token contains whitespace at position $position of $tokenLength characters: $charName"
164-
Write-Output "::error::This suggests the token secret may be malformed. Check for extra newlines when setting the secret."
165-
exit 1
166190
}
191+
} else {
192+
Write-Output "::notice::Could not detect token scopes (this is normal for fine-grained PATs). Ensure token has Contents (write) and Pull Requests (write) permissions."
193+
}
167194
168-
# Check token scopes (works for classic PATs only)
169-
$headers = curl -sS -I -H "Authorization: token $env:GH_TOKEN" https://api.github.com 2>&1
170-
$scopeLine = $headers | Select-String -Pattern '^x-oauth-scopes:' -CaseSensitive:$false
171-
if ($scopeLine) {
172-
$scopes = $scopeLine -replace '^x-oauth-scopes:\s*', '' -replace '\r', ''
173-
if ([string]::IsNullOrWhiteSpace($scopes)) {
174-
Write-Output "::warning::Token has no scopes. If using a fine-grained PAT, ensure it has Contents (write) and Pull Requests (write) permissions."
175-
} else {
176-
Write-Output "Token scopes: $scopes"
177-
if ($scopes -notmatch '\brepo\b' -and $scopes -notmatch '\bpublic_repo\b') {
178-
Write-Output "::warning::Token may be missing 'repo' or 'public_repo' scope. This may cause issues with private repositories."
179-
}
180-
}
181-
} else {
182-
Write-Output "::notice::Could not detect token scopes (this is normal for fine-grained PATs). Ensure token has Contents (write) and Pull Requests (write) permissions."
183-
}
195+
# Check token validity and access
196+
gh api repos/${{ github.repository }} --silent 2>&1 | Out-Null
197+
if ($LASTEXITCODE -ne 0) {
198+
Write-Output "::error::GitHub token validation failed. Please verify:"
199+
Write-Output " 1. Token is not empty or malformed"
200+
Write-Output " 2. Token has not expired"
201+
Write-Output " 3. Token has an expiration date set"
202+
Write-Output " 4. Token has 'repo' and 'workflow' scopes"
203+
exit 1
204+
}
205+
206+
Write-Output "✓ GitHub token is valid and has access to this repository"
207+
208+
- name: Validate SSH key
209+
if: ${{ inputs.ssh-key != '' }}
210+
shell: pwsh
211+
env:
212+
SSH_KEY: ${{ inputs.ssh-key }}
213+
run: |
214+
# Check if SSH key looks valid
215+
if ($env:SSH_KEY -notmatch '-----BEGIN') {
216+
Write-Output "::warning::SSH key does not appear to start with a PEM header (-----BEGIN). Please verify the key format."
217+
}
184218
185-
# Check token validity and access
186-
gh api repos/${{ github.repository }} --silent 2>&1 | Out-Null
187-
if ($LASTEXITCODE -ne 0) {
188-
Write-Output "::error::GitHub token validation failed. Please verify:"
189-
Write-Output " 1. Token is not empty or malformed"
190-
Write-Output " 2. Token has not expired"
191-
Write-Output " 3. Token has an expiration date set"
192-
Write-Output " 4. Token has 'repo' and 'workflow' scopes"
193-
exit 1
219+
# Check for common SSH key types
220+
$validKeyTypes = @('RSA', 'OPENSSH', 'DSA', 'EC', 'PRIVATE KEY')
221+
$hasValidType = $false
222+
foreach ($type in $validKeyTypes) {
223+
if ($env:SSH_KEY -match "-----BEGIN.*$type") {
224+
$hasValidType = $true
225+
break
194226
}
227+
}
195228
196-
Write-Output "✓ GitHub token is valid and has access to this repository"
197-
} else {
198-
Write-Output "✓ Using SSH key authentication"
229+
if (-not $hasValidType) {
230+
Write-Output "::warning::SSH key type not recognized. Supported types: RSA, OPENSSH, DSA, EC, PRIVATE KEY"
199231
}
200232
233+
Write-Output "✓ SSH key format appears valid"
234+
201235
- name: Configure git credentials
202236
if: ${{ inputs.api-token != '' }}
203237
shell: pwsh

0 commit comments

Comments
 (0)