Add token revokal as post action (#18)

* add token deletion [skip ci]

* add locally-built dist for testing [skip ci]

Author: danielefranceschi

.gitignore

@@ -13,4 +13,3 @@ coverage
 .cache
 .DS_Store
 lib
-dist

dist/action.d.ts

@@ -0,0 +1,2 @@
+export declare function run(): Promise<void>;
+export declare function cleanup(): Promise<void>;

dist/index.d.ts

@@ -0,0 +1 @@
+export {};

dist/index.js

@@ -0,0 +1 @@
+export declare const isPost: boolean;

dist/licenses.txt

@@ -0,0 +1,9 @@
+export declare function getAppSlugName(): string;
+export declare function getAppTokenName(): string;
+export declare function getAppInfo(): Promise<{
+    token: string;
+    slug: string;
+}>;
+export declare function createSecret(token: string, secretName: string, secretValue: string): Promise<void>;
+export declare function deleteSecret(token: string, secretName: string): Promise<void>;
+export declare function deleteToken(token: string): Promise<void>;

dist/state.d.ts

@@ -18,6 +18,8 @@ export async function run() {
 
     core.setOutput('BOT_NAME', slug)
     core.setOutput('BOT_TOKEN', token)
+    // save token in state to be used in cleanup
+    core.saveState('token', token)
 
     core.exportVariable(appSlugName, slug)
     core.exportVariable(appTokenName, token)
@@ -31,13 +33,18 @@ export async function cleanup() {
   try {
     const clean = core.getBooleanInput('clean')
     const saveToSecret = core.getBooleanInput('secret')
-    if (saveToSecret && clean) {
-      const { token } = await util.getAppInfo()
-      const appSlugName = util.getAppSlugName()
-      const appTokenName = util.getAppTokenName()
-      await util.deleteSecret(token, appSlugName)
-      await util.deleteSecret(token, appTokenName)
-      core.info(`Secrets "${appSlugName}" and "${appTokenName}" was removed`)
+    const token = core.getState('token');
+    if (clean) {
+      if (saveToSecret) {
+        const { token } = await util.getAppInfo()
+        const appSlugName = util.getAppSlugName()
+        const appTokenName = util.getAppTokenName()
+        await util.deleteSecret(token, appSlugName)
+        await util.deleteSecret(token, appTokenName)
+        core.info(`Secrets "${appSlugName}" and "${appTokenName}" were removed`)
+      }
+      await util.deleteToken(token);
+      core.info("Token revoked");
     }
   } catch (e) {
     core.error(e)

dist/util.d.ts

@@ -105,3 +105,10 @@ export async function deleteSecret(token: string, secretName: string) {
     },
   )
 }
+
+export async function deleteToken(token: string) {
+  const octokit = new Octokit({ auth: token })
+  await octokit.request(
+    'DELETE /installation/token',
+  )
+}