Skip to content

Keep automatic GitHub Packages credentials proxy-only #1766

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
JamieMagee wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

Keep automatic GitHub Packages credentials proxy-only #1766

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
da6e153
Keep automatic package credentials proxy-only
JamieMagee Sep 1, 2026
c6ece8b
Rebuild Action distribution with Node 24
JamieMagee Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
130 changes: 92 additions & 38 deletions __tests__/main.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -911,14 +911,15 @@ describe('getPackagesCredential', () => {
expect(cred).toEqual({
type: 'rubygems_server',
host: 'rubygems.pkg.github.com',
token: 'test-actor:test-token'
token: 'test-actor:test-token',
'proxy-only': true
})
})

it('does not create a duplicate credential', () => {
it('preserves an explicit credential using a URL', () => {
const existingCred: Credential = {
type: 'rubygems_server',
host: 'rubygems.pkg.github.com',
url: 'https://RUBYGEMS.PKG.GITHUB.COM/',
token: 'some-other-actor:some-other-token'
}
const details = createJobDetails('bundler', {[experimentName]: true}, [
Expand All @@ -939,14 +940,15 @@ describe('getPackagesCredential', () => {
type: 'docker_registry',
registry: 'ghcr.io',
username: 'test-actor',
password: 'test-token'
password: 'test-token',
'proxy-only': true
})
})

it('does not create a duplicate credential', () => {
it('preserves an explicit credential using a host', () => {
const existingCred: Credential = {
type: 'docker_registry',
registry: 'ghcr.io',
host: 'GHCR.IO/',
username: 'some-other-actor',
password: 'some-other-token'
}
Expand All @@ -970,14 +972,15 @@ describe('getPackagesCredential', () => {
type: 'docker_registry',
registry: 'ghcr.io',
username: 'test-actor',
password: 'test-token'
password: 'test-token',
'proxy-only': true
})
})

it('does not create a duplicate credential', () => {
it('creates a credential alongside an explicit path-scoped URL', () => {
const existingCred: Credential = {
type: 'docker_registry',
registry: 'ghcr.io',
url: 'https://GHCR.IO/other-owner/',
username: 'some-other-actor',
password: 'some-other-token'
}
Expand All @@ -987,7 +990,13 @@ describe('getPackagesCredential', () => {
[existingCred]
)
const cred = getPackagesCredential(details, 'test-actor')
expect(cred).toBeNull()
expect(cred).toEqual({
type: 'docker_registry',
registry: 'ghcr.io',
username: 'test-actor',
password: 'test-token',
'proxy-only': true
})
})
})
})
Expand All @@ -1003,14 +1012,15 @@ describe('getPackagesCredential', () => {
type: 'docker_registry',
registry: 'ghcr.io',
username: 'test-actor',
password: 'test-token'
password: 'test-token',
'proxy-only': true
})
})

it('does not create a duplicate credential', () => {
it('preserves an explicit credential using a registry', () => {
const existingCred: Credential = {
type: 'docker_registry',
registry: 'ghcr.io',
registry: 'GHCR.IO/',
username: 'some-other-actor',
password: 'some-other-token'
}
Expand All @@ -1032,38 +1042,51 @@ describe('getPackagesCredential', () => {
const cred = getPackagesCredential(details, 'test-actor')
expect(cred).toEqual({
type: 'maven_repository',
url: 'https://maven.pkg.github.com/test-org',
host: 'maven.pkg.github.com',
username: 'test-actor',
password: 'test-token'
password: 'test-token',
'proxy-only': true
})
})

it('does not create a duplicate credential with no trailing slash', () => {
it('creates a credential alongside an explicit cross-owner URL', () => {
const existingCred: Credential = {
type: 'maven_repository',
url: 'https://maven.pkg.github.com/TEST-ORG',
url: 'https://MAVEN.PKG.GITHUB.COM/OTHER-ORG',
username: 'some-other-actor',
password: 'some-other-token'
}
const details = createJobDetails('maven', {[experimentName]: true}, [
existingCred
])
const cred = getPackagesCredential(details, 'test-actor')
expect(cred).toBeNull()
expect(cred).toEqual({
type: 'maven_repository',
host: 'maven.pkg.github.com',
username: 'test-actor',
password: 'test-token',
'proxy-only': true
})
})

it('does not create a duplicate credential with a trailing slash', () => {
it('creates a credential alongside an explicit path-scoped registry', () => {
const existingCred: Credential = {
type: 'maven_repository',
url: 'https://maven.pkg.github.com/TEST-ORG/',
registry: 'MAVEN.PKG.GITHUB.COM/OTHER-ORG/',
username: 'some-other-actor',
password: 'some-other-token'
}
const details = createJobDetails('maven', {[experimentName]: true}, [
existingCred
])
const cred = getPackagesCredential(details, 'test-actor')
expect(cred).toBeNull()
expect(cred).toEqual({
type: 'maven_repository',
host: 'maven.pkg.github.com',
username: 'test-actor',
password: 'test-token',
'proxy-only': true
})
})
})
})
Expand All @@ -1075,16 +1098,17 @@ describe('getPackagesCredential', () => {
const cred = getPackagesCredential(details, 'test-actor')
expect(cred).toEqual({
type: 'maven_repository',
url: 'https://maven.pkg.github.com/test-org',
host: 'maven.pkg.github.com',
username: 'test-actor',
password: 'test-token'
password: 'test-token',
'proxy-only': true
})
})

it('does not create a duplicate credential', () => {
it('preserves an explicit host-wide credential', () => {
const existingCred: Credential = {
type: 'maven_repository',
url: 'https://maven.pkg.github.com/TEST-ORG',
host: 'MAVEN.PKG.GITHUB.COM/',
username: 'some-other-actor',
password: 'some-other-token'
}
Expand All @@ -1107,14 +1131,15 @@ describe('getPackagesCredential', () => {
expect(cred).toEqual({
type: 'npm_registry',
registry: 'npm.pkg.github.com',
token: 'test-actor:test-token'
token: 'test-actor:test-token',
'proxy-only': true
})
})

it('does not create a duplicate credential', () => {
it('preserves an explicit credential using a URL', () => {
const existingCred: Credential = {
type: 'npm_registry',
registry: 'npm.pkg.github.com',
url: 'https://NPM.PKG.GITHUB.COM/',
token: 'some-other-actor:some-other-token'
}
const details = createJobDetails(
Expand All @@ -1125,6 +1150,26 @@ describe('getPackagesCredential', () => {
const cred = getPackagesCredential(details, 'test-actor')
expect(cred).toBeNull()
})

it('creates a credential alongside an explicit path-scoped URL', () => {
const existingCred: Credential = {
type: 'npm_registry',
url: 'https://NPM.PKG.GITHUB.COM/some-path/',
token: 'some-other-actor:some-other-token'
}
const details = createJobDetails(
'npm_and_yarn',
{[experimentName]: true},
[existingCred]
)
const cred = getPackagesCredential(details, 'test-actor')
expect(cred).toEqual({
type: 'npm_registry',
registry: 'npm.pkg.github.com',
token: 'test-actor:test-token',
'proxy-only': true
})
})
})
})

Expand All @@ -1136,14 +1181,15 @@ describe('getPackagesCredential', () => {
expect(cred).toEqual({
type: 'npm_registry',
registry: 'npm.pkg.github.com',
token: 'test-actor:test-token'
token: 'test-actor:test-token',
'proxy-only': true
})
})

it('does not create a duplicate credential', () => {
it('preserves an explicit credential using a registry', () => {
const existingCred: Credential = {
type: 'npm_registry',
registry: 'npm.pkg.github.com',
registry: 'NPM.PKG.GITHUB.COM/',
token: 'some-other-actor:some-other-token'
}
const details = createJobDetails('bun', {[experimentName]: true}, [
Expand Down Expand Up @@ -1187,9 +1233,10 @@ describe('getPackagesCredential', () => {
const cred = getPackagesCredential(details, 'test-actor')
expect(cred).toEqual({
type: 'nuget_feed',
url: 'https://nuget.pkg.github.com/test-org/index.json',
host: 'nuget.pkg.github.com',
username: 'test-actor',
password: 'test-token'
password: 'test-token',
'proxy-only': true
})
})

Expand All @@ -1200,24 +1247,31 @@ describe('getPackagesCredential', () => {
const cred = getPackagesCredential(details, 'test-actor')
expect(cred).toEqual({
type: 'nuget_feed',
url: 'https://nuget.pkg.github.com/test-org/index.json',
host: 'nuget.pkg.github.com',
username: 'test-actor',
password: 'test-token'
password: 'test-token',
'proxy-only': true
})
})

it('does not create a duplicate credential', () => {
it('creates a credential alongside an explicit cross-owner URL', () => {
const existingCred: Credential = {
type: 'nuget_feed',
url: 'https://nuget.pkg.github.com/TEST-ORG/index.json',
url: 'https://NUGET.PKG.GITHUB.COM/OTHER-ORG/index.json/',
username: 'some-other-actor',
password: 'some-other-token'
}
const details = createJobDetails('nuget', {[experimentName]: true}, [
existingCred
])
const cred = getPackagesCredential(details, 'test-actor')
expect(cred).toBeNull()
expect(cred).toEqual({
type: 'nuget_feed',
host: 'nuget.pkg.github.com',
username: 'test-actor',
password: 'test-token',
'proxy-only': true
})
})
})
})
Expand Down
43 changes: 40 additions & 3 deletions __tests__/proxy.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
import * as core from '@actions/core'
import Docker, {Container, Network} from 'dockerode'
import {PassThrough} from 'node:stream'
import {ApiClient, JobDetails} from '../src/api-client'
import {ApiClient, Credential, JobDetails} from '../src/api-client'
import {ContainerService} from '../src/container-service'
import {Proxy, ProxyBuilder} from '../src/proxy'
import {Updater} from '../src/updater'
Expand All @@ -22,7 +22,8 @@ async function buildProxyWithStopError(
stopError: Error,
containerRemoveError?: Error,
containerRemoveOverride?: jest.Mock,
experiments: object = {}
experiments: object = {},
credentials: Credential[] = []
): Promise<ProxyTestResources> {
const containerRemove =
containerRemoveOverride ??
Expand Down Expand Up @@ -63,7 +64,7 @@ async function buildProxyWithStopError(
1,
'job-token',
'https://dependabot-api.example.com',
[]
credentials
)

return {
Expand Down Expand Up @@ -145,6 +146,42 @@ describe('Proxy config', () => {
storeInput.mockRestore()
}
})

it('forwards proxy-only credentials in full', async () => {
const credentials: Credential[] = [
{
type: 'nuget_feed',
host: 'nuget.pkg.github.com',
username: 'dependabot[bot]',
password: 'github-token',
'proxy-only': true
}
]
const storeInput = jest
.spyOn(ContainerService, 'storeInput')
.mockResolvedValue(undefined)

try {
await buildProxyWithStopError(
alreadyStoppedError(),
undefined,
undefined,
{},
credentials
)

expect(storeInput).toHaveBeenCalledWith(
'config.json',
'/',
expect.anything(),
expect.objectContaining({
all_credentials: credentials
})
)
} finally {
storeInput.mockRestore()
}
})
})

describe('Proxy environment', () => {
Expand Down
Loading
Loading