Skip to content

Commit 2681afe

Browse files
janb87janb87
authored
fix: auto connect for aat tokens (#162)
## Summary by Sourcery Fix auto-connect logic to disable automatic workspace connection when using application access tokens by default, add a helper to derive auto-connect behavior, update related docs, action metadata, and tests. Bug Fixes: - Default auto-connect to false for application access tokens to prevent unintended connections Enhancements: - Introduce getAutoConnect helper to derive auto-connect behavior based on token type or explicit input - Convert auto-connect flag to a boolean and remove its default true from action inputs Documentation: - Update README and action.yml to reflect new auto-connect defaults and improve formatting Tests: - Add test for application access token scenario to verify no login or connect is performed when auto-connect is not enabled
1 parent 475a277 commit 2681afe

File tree

6 files changed

+109
-58
lines changed

6 files changed

+109
-58
lines changed

‎README.md‎

Lines changed: 34 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -72,27 +72,27 @@ steps:
7272
7373
### Optional
7474
75-
| Input | Description | Default |
76-
| ------------------ | ---------------------------------- | ------------------------------------------------------------------- |
77-
| command | CLI command to execute | - |
78-
| version | CLI version to install | 'latest' |
79-
| auto-connect | Automatically connect to workspace | 'true' (only executed when access-token is a personal access token) |
80-
| instance | SettleMint instance URL | 'https://console.settlemint.com' |
81-
| workspace | Workspace unique name | - |
82-
| application | Application unique name | - |
83-
| blockchain-network | Blockchain network unique name | - |
84-
| blockchain-node | Blockchain node unique name | - |
85-
| load-balancer | Load balancer unique name | - |
86-
| hasura | Hasura unique name | - |
87-
| thegraph | TheGraph unique name | - |
88-
| portal | Portal unique name | - |
89-
| hd-private-key | HD private key | - |
90-
| minio | MinIO unique name | - |
91-
| ipfs | IPFS unique name | - |
92-
| custom-deployment | Custom deployment unique name | - |
93-
| blockscout | Blockscout unique name | - |
94-
| dotEnvFile | .env file content (store in secrets) | - |
95-
| dotEnvLocalFile | .env.local file content (store in secrets) | - |
75+
| Input | Description | Default |
76+
| ------------------ | ------------------------------------------ | ----------------------------------------------------------------- |
77+
| command | CLI command to execute | - |
78+
| version | CLI version to install | 'latest' |
79+
| auto-connect | Automatically connect to workspace | 'true' (personal access token) 'false' (application access token) |
80+
| instance | SettleMint instance URL | 'https://console.settlemint.com' |
81+
| workspace | Workspace unique name | - |
82+
| application | Application unique name | - |
83+
| blockchain-network | Blockchain network unique name | - |
84+
| blockchain-node | Blockchain node unique name | - |
85+
| load-balancer | Load balancer unique name | - |
86+
| hasura | Hasura unique name | - |
87+
| thegraph | TheGraph unique name | - |
88+
| portal | Portal unique name | - |
89+
| hd-private-key | HD private key | - |
90+
| minio | MinIO unique name | - |
91+
| ipfs | IPFS unique name | - |
92+
| custom-deployment | Custom deployment unique name | - |
93+
| blockscout | Blockscout unique name | - |
94+
| dotEnvFile | .env file content (store in secrets) | - |
95+
| dotEnvLocalFile | .env.local file content (store in secrets) | - |
9696
9797
## Common Use Cases
9898
@@ -212,35 +212,43 @@ steps:
212212
### Common Issues
213213

214214
#### Invalid Access Token
215+
215216
**Error**: `Failed to authenticate with SettleMint: Error: Process completed with exit code 1. Please check your access token.`
216217

217-
**Solution**:
218+
**Solution**:
219+
218220
- Ensure your access token is correctly stored in GitHub Secrets
219221
- Verify the token hasn't expired
220222
- Check that you're using the correct token format:
221223
- Personal Access Tokens: `sm_pat_xxxxx`
222224
- Application Tokens: `sm_app_xxxxx`
223225

224226
#### Command Injection Prevention
227+
225228
**Error**: `Command contains potentially dangerous characters. Please use simple commands only.`
226229

227230
**Solution**:
231+
228232
- Avoid using shell operators like `&&`, `||`, `;`, `|`, or backticks
229233
- Use simple, direct commands
230234
- If you need to run multiple commands, use multiple action steps
231235

232236
#### Version Installation Failures
237+
233238
**Error**: `Invalid version format: x.x.x. Must be a valid semver version or 'latest'`
234239

235240
**Solution**:
241+
236242
- Use valid semantic version numbers (e.g., `1.0.0`, `2.1.3`)
237243
- Use `latest` for the most recent version
238244
- Don't use version ranges or npm tags other than `latest`
239245

240246
#### Environment Variable Issues
247+
241248
**Problem**: Environment variables from `.env` files aren't being loaded
242249

243250
**Solution**:
251+
244252
- Ensure the env file content is stored in GitHub Secrets
245253
- Check that the file content follows the correct format:
246254
```
@@ -251,16 +259,19 @@ steps:
251259
- Verify no shell metacharacters are in your values
252260

253261
#### CLI Not Found
262+
254263
**Error**: `settlemint: command not found`
255264

256265
**Solution**:
266+
257267
- The action should automatically install the CLI
258268
- If using a self-hosted runner, ensure npm is available
259269
- Check the action logs for installation errors
260270

261271
### Debugging Tips
262272

263273
1. **Enable Debug Logging**:
274+
264275
```yaml
265276
- name: Run SettleMint CLI
266277
uses: settlemint/settlemint-action@main
@@ -276,6 +287,7 @@ steps:
276287

277288
3. **Verify Workspace Connection**:
278289
If auto-connect fails, try connecting manually first:
290+
279291
```yaml
280292
- name: Connect to Workspace
281293
uses: settlemint/settlemint-action@main

‎__tests__/main.test.ts‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,8 +96,6 @@ describe('action', () => {
9696
return 'status';
9797
case 'version':
9898
return 'latest';
99-
case 'auto-connect':
100-
return 'true';
10199
case 'access-token':
102100
return 'sm_pat_1234567890';
103101
default:
@@ -149,6 +147,34 @@ describe('action', () => {
149147
expect(execMock).toHaveBeenCalledWith('npx -y @settlemint/sdk-cli@latest', ['status']);
150148
}, 30_000);
151149

150+
it('does not login and does not connect when using an application access token without auto-connect', async () => {
151+
getInputMock.mockImplementation((name) => {
152+
switch (name) {
153+
case 'command':
154+
return 'status';
155+
case 'version':
156+
return 'latest';
157+
case 'access-token':
158+
return 'sm_app_1234567890';
159+
default:
160+
return '';
161+
}
162+
});
163+
164+
await main.run();
165+
166+
// Application token should be set as environment variable
167+
expect(process.env.SETTLEMINT_ACCESS_TOKEN).toBe('sm_app_1234567890');
168+
169+
// Access token should be masked
170+
expect(_setSecretMock).toHaveBeenCalledWith('sm_app_1234567890');
171+
172+
// Should NOT login with app token, but should still connect because auto-connect is true
173+
expect(execMock).not.toHaveBeenCalledWith('npx -y @settlemint/sdk-cli@latest', ['login', '-a']);
174+
expect(execMock).not.toHaveBeenCalledWith('npx -y @settlemint/sdk-cli@latest', ['connect', '-a']);
175+
expect(execMock).toHaveBeenCalledWith('npx -y @settlemint/sdk-cli@latest', ['status']);
176+
}, 30_000);
177+
152178
it('sets environment variables when provided', async () => {
153179
getInputMock.mockImplementation((name) => {
154180
switch (name) {

‎action.yml‎

Lines changed: 27 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,75 +1,73 @@
1-
name: 'SettleMint CLI Action'
2-
description: 'Execute SettleMint CLI commands in your GitHub Actions workflow'
3-
author: 'SettleMint'
1+
name: "SettleMint CLI Action"
2+
description: "Execute SettleMint CLI commands in your GitHub Actions workflow"
3+
author: "SettleMint"
44

55
branding:
6-
icon: 'terminal'
7-
color: 'blue'
6+
icon: "terminal"
7+
color: "blue"
88

99
inputs:
1010
command:
11-
description: 'The SettleMint CLI command to execute'
11+
description: "The SettleMint CLI command to execute"
1212
required: false
1313
access-token:
14-
description: 'SettleMint Access Token (can be a personal or an application access token)'
14+
description: "SettleMint Access Token (can be a personal or an application access token)"
1515
required: false
1616
auto-connect:
17-
description: 'Automatically connect to SettleMint'
17+
description: "Automatically connect to SettleMint"
1818
required: false
19-
default: 'true'
2019
version:
21-
description: 'SettleMint CLI version to install (defaults to latest)'
20+
description: "SettleMint CLI version to install (defaults to latest)"
2221
required: false
23-
default: 'latest'
22+
default: "latest"
2423
instance:
25-
description:
26-
'SettleMint instance URL (defaults to https://console.settlemint.com)'
24+
description: "SettleMint instance URL (defaults to https://console.settlemint.com)"
2725
required: false
28-
default: 'https://console.settlemint.com'
26+
default: "https://console.settlemint.com"
2927
workspace:
30-
description: 'SettleMint workspace unique name'
28+
description: "SettleMint workspace unique name"
3129
required: false
3230
application:
33-
description: 'SettleMint application unique name'
31+
description: "SettleMint application unique name"
3432
required: false
3533
blockchain-network:
36-
description: 'SettleMint blockchain network unique name'
34+
description: "SettleMint blockchain network unique name"
3735
required: false
3836
blockchain-node:
39-
description: 'SettleMint blockchain node unique name'
37+
description: "SettleMint blockchain node unique name"
4038
required: false
4139
load-balancer:
42-
description: 'SettleMint load balancer unique name'
40+
description: "SettleMint load balancer unique name"
4341
required: false
4442
hasura:
45-
description: 'SettleMint Hasura unique name'
43+
description: "SettleMint Hasura unique name"
4644
required: false
4745
thegraph:
48-
description: 'SettleMint TheGraph unique name'
46+
description: "SettleMint TheGraph unique name"
4947
required: false
5048
portal:
51-
description: 'SettleMint Portal unique name'
49+
description: "SettleMint Portal unique name"
5250
required: false
5351
hd-private-key:
54-
description: 'SettleMint HD private key unique name'
52+
description: "SettleMint HD private key unique name"
5553
required: false
5654
minio:
57-
description: 'SettleMint MinIO unique name'
55+
description: "SettleMint MinIO unique name"
5856
required: false
5957
ipfs:
60-
description: 'SettleMint IPFS unique name'
58+
description: "SettleMint IPFS unique name"
6159
required: false
6260
custom-deployment:
63-
description: 'SettleMint custom deployment unique name'
61+
description: "SettleMint custom deployment unique name"
6462
required: false
6563
blockscout:
66-
description: 'SettleMint Blockscout unique name'
64+
description: "SettleMint Blockscout unique name"
6765
required: false
6866
dotEnvFile:
69-
description: 'A Github Actions secret containing the .env file, loaded in one go for easy updates'
67+
description: "A Github Actions secret containing the .env file, loaded in one go for easy updates"
7068
required: false
7169
dotEnvLocalFile:
72-
description: 'A Github Actions secret containing the .env.local file, loaded in one go for easy updates'
70+
description: "A Github Actions secret containing the .env.local file, loaded in one go for easy updates"
7371
required: false
7472

7573
runs:

‎dist/index.js‎

Lines changed: 9 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/index.js.map‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/main.ts‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -259,6 +259,14 @@ function setEnvironmentVariables(inputs: Map<string, string>): void {
259259
}
260260
}
261261

262+
function getAutoConnect(accessToken: string): boolean {
263+
const autoConnectValue = core.getInput('auto-connect');
264+
if (!autoConnectValue) {
265+
return isPersonalAccessToken(accessToken);
266+
}
267+
return autoConnectValue === 'true';
268+
}
269+
262270
/**
263271
* The main function for the action.
264272
* @returns {Promise<void>} Resolves when the action is complete.
@@ -268,7 +276,7 @@ export async function run(): Promise<void> {
268276
const command = core.getInput('command');
269277
const version = core.getInput('version');
270278
const accessToken = core.getInput('access-token');
271-
const autoConnect = core.getInput('auto-connect');
279+
const autoConnect = getAutoConnect(accessToken);
272280
const instance = core.getInput('instance');
273281

274282
// Validate version
@@ -311,7 +319,7 @@ export async function run(): Promise<void> {
311319
}
312320

313321
// Only connect if not in standalone mode and auto-connect is enabled
314-
if (!isStandalone && autoConnect === 'true') {
322+
if (!isStandalone && autoConnect) {
315323
await exec.exec(settlemintCmd, ['connect', '-a']);
316324
}
317325

0 commit comments

Comments
 (0)