token_test.go RawHistoryFolder

1// SPDX-License-Identifier: MIT
2
3package executor
4
5import (
6	"encoding/base64"
7	"strings"
8	"testing"
9)
10
11// Recorded on github.com (ctx-inputs-vars): secrets.GITHUB_TOKEN is set and
12// equals github.token. The token comes from the github context the server
13// sends; it is masked in the log.
14func TestSecretsHoldTheGithubToken(t *testing.T) {
15	needTools(t, "bash")
16	const tok = "ghs_testtoken123"
17	yaml := `on: push
18jobs:
19  main:
20    runs-on: ubuntu-24.04
21    steps:
22      - name: absent values
23        env:
24          V_SET: ${{ secrets.GITHUB_TOKEN != '' }}
25          V_EQ: ${{ secrets.GITHUB_TOKEN == github.token }}
26          V_NONE: ${{ secrets.NOT_DEFINED }}
27          V_TOKEN: ${{ secrets.GITHUB_TOKEN }}
28        run: |
29          echo "V_SET=$V_SET V_EQ=$V_EQ V_NONE=$V_NONE"
30          echo "token=$V_TOKEN b64=` + base64.StdEncoding.EncodeToString([]byte("x-access-token:"+tok)) + `"
31`
32	rec, res := runLocal(t, yaml, "main", func(c *Config) {
33		c.ContextsJSON = strings.Replace(testGitHubContext("main"), `"github":{`, `"github":{"token":"`+tok+`",`, 1)
34	})
35	if res.Conclusion != ConclusionSuccess {
36		t.Fatalf("%+v", res)
37	}
38	log := logOf(rec.step(t, "absent values"))
39	if !strings.Contains(log, "V_SET=true V_EQ=true V_NONE=\n") {
40		t.Errorf("log:\n%s", log)
41	}
42	if strings.Contains(log, tok) || strings.Contains(log, "eC1hY2Nlc3MtdG9rZW46") {
43		t.Errorf("the token leaked into the log:\n%s", log)
44	}
45	if !strings.Contains(log, "  V_TOKEN: ***") || !strings.Contains(log, "token=*** b64=***") {
46		t.Errorf("the token must be masked:\n%s", log)
47	}
48}
49
50// Without a token from the server the secrets context is empty and nothing is
51// masked.
52func TestSecretsWithoutToken(t *testing.T) {
53	s := newTestState(t)
54	if d := s.Values(nil)["secrets"]; d == nil || len(s.Secrets()) != 0 {
55		t.Fatalf("%v %v", d, s.Secrets())
56	}
57}