From adab16fb45c860973d3f2e6c9cc6eccc8e517918 Mon Sep 17 00:00:00 2001 From: Jeffery Date: Wed, 15 Jul 2026 11:21:08 +0800 Subject: [PATCH 1/2] =?UTF-8?q?refactor(cleanup-release):=20=E7=A7=BB?= =?UTF-8?q?=E9=99=A4=20RUNNER=5FTOKEN=20=E8=BC=B8=E5=85=A5=EF=BC=8C?= =?UTF-8?q?=E4=B8=80=E5=BE=8B=E6=94=B9=E7=94=A8=20Gitea=20=E8=87=AA?= =?UTF-8?q?=E5=8B=95=20token?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - action.yml 移除 RUNNER_TOKEN input 與 secrets 回退鏈，env 簡化為 GITEA_TOKEN: ${{ gitea.token }} - src/index.js 環境變數與 log 訊息同步改名為 GITEA_TOKEN，遮罩行為不變 - 自動 token 權限僅限當前 repo 且 job 結束即失效，已足夠本 action 的 release/tag 清理需求 Co-Authored-By: Claude Fable 5 --- action.yml | 10 +++------- src/index.js | 10 +++++----- 2 files changed, 8 insertions(+), 12 deletions(-) diff --git a/action.yml b/action.yml index dd34818..8a391e4 100644 --- a/action.yml +++ b/action.yml @@ -1,5 +1,5 @@ # 檔案用途：定義 CLEANUP OLD RELEASES 這個 Docker action 的輸入參數與執行環境 -# 更新日期：2026/07/11 21:02:25 +# 更新日期：2026/07/15 11:17:00 # Action 名稱，會顯示在 action 市集與文件中 name: 'CLEANUP OLD RELEASES' @@ -12,10 +12,6 @@ author: 'Jeffery' # 定義可由使用者或呼叫端傳入的輸入參數 inputs: - # RUNNER_TOKEN 用於授權呼叫 Gitea API；未提供時會改用 secrets - RUNNER_TOKEN: - # 參數說明，讓呼叫端知道這是 Runner Token - description: 'Gitea Runner Token' # KEEP_COUNT 用於控制保留的 release 數量 KEEP_COUNT: # 參數說明，這裡表示保留的版本數量 @@ -35,7 +31,7 @@ runs: GITEA_SERVER_URL: ${{ gitea.server_url }} # GITEA_REPOSITORY 由 Gitea runtime 注入，供程式指定目標 repo GITEA_REPOSITORY: ${{ gitea.repository }} - # 優先使用傳入的 RUNNER_TOKEN，否則退回 Gitea token secrets - RUNNER_TOKEN: ${{ inputs.RUNNER_TOKEN || secrets.GITEA_TOKEN || secrets.RUNNER_TOKEN }} + # 使用 Gitea runtime 自動核發的 token，權限僅限當前 repo 且 job 結束即失效 + GITEA_TOKEN: ${{ gitea.token }} # KEEP_COUNT 直接沿用輸入值，交由程式驗證 KEEP_COUNT: ${{ inputs.KEEP_COUNT }} diff --git a/src/index.js b/src/index.js index dfaafb1..a3fd6cc 100644 --- a/src/index.js +++ b/src/index.js @@ -400,7 +400,7 @@ function hasBatchFailure(results) { async function main() { const GITEA_SERVER_URL = normalizeEnvValue(process.env.GITEA_SERVER_URL); const GITEA_REPOSITORY = normalizeEnvValue(process.env.GITEA_REPOSITORY); - const RUNNER_TOKEN = normalizeEnvValue(process.env.RUNNER_TOKEN) ?? ''; + const GITEA_TOKEN = normalizeEnvValue(process.env.GITEA_TOKEN) ?? ''; const KEEP_COUNT = normalizeEnvValue(process.env.KEEP_COUNT) ?? ''; const MAX_PAGES = normalizeEnvValue(process.env.MAX_PAGES) ?? ''; @@ -421,11 +421,11 @@ async function main() { const keepCount = Number(KEEP_COUNT); const authHeaders = {}; - if (isEmptyOrNull(RUNNER_TOKEN)) { - warn('RUNNER_TOKEN is empty; release API calls will be anonymous'); + if (isEmptyOrNull(GITEA_TOKEN)) { + warn('GITEA_TOKEN is empty; release API calls will be anonymous'); } else { - info('RUNNER_TOKEN=[redacted]'); - authHeaders.Authorization = `token ${RUNNER_TOKEN}`; + info('GITEA_TOKEN=[redacted]'); + authHeaders.Authorization = `token ${GITEA_TOKEN}`; } const serverBase = new URL(GITEA_SERVER_URL); From 779701adb24685760f2aa4685b4a0a9bd927cf14 Mon Sep 17 00:00:00 2001 From: AI Review Bot Date: Wed, 15 Jul 2026 03:25:32 +0000 Subject: [PATCH 2/2] chore: update ai-review findings [ai-review-bot][success] --- .gitea/ai-review/findings.json | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/.gitea/ai-review/findings.json b/.gitea/ai-review/findings.json index fe51488..1672c0b 100644 --- a/.gitea/ai-review/findings.json +++ b/.gitea/ai-review/findings.json @@ -1 +1,18 @@ -[] +[ + { + "level": "warning", + "role": "Maya", + "location": "action.yml:40", + "problem": "這裡把 action 內注入的 token 改成 `GITEA_TOKEN`，但沒有任何測試去鎖住這個 workflow 契約；只要 YAML 欄位名稱或注入來源寫錯，程式就會默默退回匿名呼叫，錯誤很難被第一時間發現。", + "suggestion": "補一個整合測試或 action 介面測試，驗證執行時確實會把 `gitea.token` 帶進 `process.env.GITEA_TOKEN`，且不再依賴舊的 `RUNNER_TOKEN` 輸入。", + "is_new": true + }, + { + "level": "warning", + "role": "Maya", + "location": "src/index.js:426", + "problem": "有 token 時會改成記錄 redacted 訊息並建立 `Authorization` header，但目前看不到任何測試在保護這個授權分支；一旦 header 格式或遮蔽輸出出錯，就可能讓 API 請求失敗或把敏感值寫進 log。", + "suggestion": "補一個有 token 的案例，驗證 log 只會出現 `[redacted]`，而實際送出的 header 會是 `token ${GITEA_TOKEN}`，同時不要把明文 token 暴露到輸出中。", + "is_new": true + } +]