fix: harden the action

.github/workflows/ci.yml

@@ -3,21 +3,26 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '16'
+          node-version: '20'
           cache: 'yarn'
 
       - name: Install dependencies
         run: |
-          yarn install
+          yarn install --frozen-lockfile
 
       - name: Lint
         run: |
@@ -26,25 +31,27 @@ jobs:
   build:
     runs-on: ubuntu-latest
     if: ${{ github.ref == 'refs/heads/main' }}
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Set up Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '16'
+          node-version: '20'
           cache: 'yarn'
 
       - name: Install dependencies
         run: |
-          yarn install
+          yarn install --frozen-lockfile
 
       - name: Build dist
         run: |
           yarn build
 
       - name: Push changes
-        uses: stefanzweifel/git-auto-commit-action@v4
+        uses: stefanzweifel/git-auto-commit-action@3ea6ae190baf489ba007f7c92608f33ce20ef04a # v4.16.0
         with:
           commit_message: "chore(build): auto-generate dist"
           commit_user_name: "github-actions[bot]"
@@ -56,8 +63,11 @@ jobs:
     if: ${{ github.ref == 'refs/heads/main' }}
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
-      - uses: google-github-actions/release-please-action@v3
+      - uses: google-github-actions/release-please-action@db8f2c60ee802b3748b512940dde88eabd7b7e01 # v3.7.13
         id: release
         with:
           release-type: simple

.github/workflows/update-main-version.yml

@@ -14,18 +14,26 @@ on:
         options:
           - v1
 
+permissions:
+  contents: write
+
 jobs:
   tag:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         fetch-depth: 0
     - name: Git config
       run: |
         git config user.name github-actions
         git config user.email github-actions@github.com
     - name: Tag new target
-      run: git tag -f ${{ github.event.inputs.major_version }} ${{ github.event.inputs.target }}
+      env:
+        MAJOR_VERSION: ${{ github.event.inputs.major_version }}
+        TARGET: ${{ github.event.inputs.target }}
+      run: git tag -f "$MAJOR_VERSION" "$TARGET"
     - name: Push new tag
-      run: git push origin ${{ github.event.inputs.major_version }} --force
+      env:
+        MAJOR_VERSION: ${{ github.event.inputs.major_version }}
+      run: git push origin "$MAJOR_VERSION" --force

action.yml

@@ -3,7 +3,7 @@ description: 'Get a Github access token to access a private repo managed by Stai
 author: Stainless
 
 runs:
-  using: 'node16'
+  using: 'node20'
   main: 'dist/index.js'
 
 inputs:

dist/index.js

@@ -27568,6 +27568,7 @@ async function main() {
 
     const result = await retrieveGithubAccessToken(fullRepo, apiKey);
 
+    core.setSecret(result.token);
     core.setOutput('github_access_token', result.token);
   } catch (err) {
     core.setFailed(`retrieve-github-access-token failed: ${err.message}`);
@@ -27608,11 +27609,9 @@ async function retrieveGithubAccessToken(fullRepo, apiKey) {
 
   const data = safeJson(text);
   if (data instanceof Error) {
-    throw new Error(`Could not process API response. text=${text} data=${data} status=${res.status}`);
+    throw new Error(`Could not process API response. status=${res.status} parseError=${data.message}`);
   }
 
-  console.log('API Response', data);
-
   if (data?.error) {
     throw new Error(`API Error ${res.status} - ${data.error}`);
   }
@@ -27624,6 +27623,8 @@ async function retrieveGithubAccessToken(fullRepo, apiKey) {
   if (data?.token) {
     return { token: data.token };
   }
+
+  throw new Error(`API response did not include a token. status=${res.status}`);
 }
 
 /**

index.js

@@ -9,6 +9,7 @@ async function main() {
 
     const result = await retrieveGithubAccessToken(fullRepo, apiKey);
 
+    core.setSecret(result.token);
     core.setOutput('github_access_token', result.token);
   } catch (err) {
     core.setFailed(`retrieve-github-access-token failed: ${err.message}`);
@@ -49,11 +50,9 @@ async function retrieveGithubAccessToken(fullRepo, apiKey) {
 
   const data = safeJson(text);
   if (data instanceof Error) {
-    throw new Error(`Could not process API response. text=${text} data=${data} status=${res.status}`);
+    throw new Error(`Could not process API response. status=${res.status} parseError=${data.message}`);
   }
 
-  console.log('API Response', data);
-
   if (data?.error) {
     throw new Error(`API Error ${res.status} - ${data.error}`);
   }
@@ -65,6 +64,8 @@ async function retrieveGithubAccessToken(fullRepo, apiKey) {
   if (data?.token) {
     return { token: data.token };
   }
+
+  throw new Error(`API response did not include a token. status=${res.status}`);
 }
 
 /**