Merge b13eccf351 into ff7abcd0c3

__test__/git-auth-helper.test.ts

@@ -595,14 +595,11 @@ describe('git-auth-helper tests', () => {
       await authHelper.configureSubmoduleAuth()
 
       // Assert
-      // Should get submodule config paths (1 call) and configure insteadOf (2 calls for two values)
       expect(mockSubmoduleForeach).toHaveBeenCalledTimes(4)
       expect(mockSubmoduleForeach.mock.calls[0][0]).toMatch(
         /unset-all.*insteadOf/
       )
-      expect(mockSubmoduleForeach.mock.calls[1][0]).toMatch(
+      expect(mockSubmoduleForeach.mock.calls[1][0]).toMatch(/http.*extraheader/)
-        /show-origin.*remote\.origin\.url/
-      )
       expect(mockSubmoduleForeach.mock.calls[2][0]).toMatch(
         /url.*insteadOf.*git@github.com:/
       )
@@ -637,14 +634,11 @@ describe('git-auth-helper tests', () => {
       await authHelper.configureSubmoduleAuth()
 
       // Assert
-      // Should get submodule config paths (1 call) and configure sshCommand (1 call)
       expect(mockSubmoduleForeach).toHaveBeenCalledTimes(3)
       expect(mockSubmoduleForeach.mock.calls[0][0]).toMatch(
         /unset-all.*insteadOf/
       )
-      expect(mockSubmoduleForeach.mock.calls[1][0]).toMatch(
+      expect(mockSubmoduleForeach.mock.calls[1][0]).toMatch(/http.*extraheader/)
-        /show-origin.*remote\.origin\.url/
-      )
       expect(mockSubmoduleForeach.mock.calls[2][0]).toMatch(/core\.sshCommand/)
     }
   )
@@ -782,7 +776,6 @@ async function setup(testName: string): Promise<void> {
   await fs.promises.mkdir(tempHomedir, {recursive: true})
   process.env['RUNNER_TEMP'] = runnerTemp
   process.env['HOME'] = tempHomedir
-  process.env['GITHUB_WORKSPACE'] = workspace
 
   // Create git config
   globalGitConfigPath = path.join(tempHomedir, '.gitconfig')

dist/index.js

@@ -163,7 +163,7 @@ class GitAuthHelper {
         this.sshKnownHostsPath = '';
         this.temporaryHomePath = '';
         this.credentialsConfigPath = ''; // Path to separate credentials config file in RUNNER_TEMP
-        this.credentialsIncludeKeys = []; // Track includeIf config keys for cleanup
+        this.credentialsIncludeKeys = []; // Track includeIf/include config keys for cleanup
         this.git = gitCommandManager;
         this.settings = gitSourceSettings || {};
         // Token auth header
@@ -268,37 +268,20 @@ class GitAuthHelper {
     configureSubmoduleAuth() {
         return __awaiter(this, void 0, void 0, function* () {
             // Remove possible previous HTTPS instead of SSH
-            yield this.removeSubmoduleGitConfig(this.insteadOfKey);
+            yield this.removeGitConfig(this.insteadOfKey, true);
             if (this.settings.persistCredentials) {
-                // Credentials config path
+                // TODO: UPDATE THIS
-                const credentialsConfigPath = yield this.getCredentialsConfigPath();
+                // Configure a placeholder value. This approach avoids the credential being captured
-                // Container credentials config path
+                // by process creation audit events, which are commonly logged. For more information,
-                const containerCredentialsPath = path.posix.join('/github/runner_temp', path.basename(credentialsConfigPath));
+                // refer to https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing
-                // Container repo path
+                const output = yield this.git.submoduleForeach(
-                const workingDirectory = this.git.getWorkingDirectory();
+                // Wrap the pipeline in quotes to make sure it's handled properly by submoduleForeach, rather than just the first part of the pipeline
-                const githubWorkspace = process.env['GITHUB_WORKSPACE'];
+                `sh -c "git config --local '${this.tokenConfigKey}' '${this.tokenPlaceholderConfigValue}' && git config --local --show-origin --name-only --get-regexp remote.origin.url"`, this.settings.nestedSubmodules);
-                assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined');
+                // Replace the placeholder
-                let relativePath = path.relative(githubWorkspace, workingDirectory);
-                relativePath = relativePath.replace(/\\/g, '/');
-                const containerRepoPath = path.posix.join('/github/workspace', relativePath);
-                // Get submodule config file paths.
-                // Use `--show-origin` to get the config file path for each submodule.
-                const output = yield this.git.submoduleForeach(`git config --local --show-origin --name-only --get-regexp remote.origin.url`, this.settings.nestedSubmodules);
-                // Extract config file paths from the output (lines starting with "file:").
                 const configPaths = output.match(/(?<=(^|\n)file:)[^\t]+(?=\tremote\.origin\.url)/g) || [];
-                // For each submodule, configure includeIf entries pointing to the shared credentials file.
-                // Configure both host and container paths to support Docker container actions.
                 for (const configPath of configPaths) {
-                    // The config file is at .git/modules/submodule-name/config
+                    core.debug(`Replacing token placeholder in '${configPath}'`);
-                    let submoduleConfigDir = path.dirname(configPath);
+                    yield this.replaceTokenPlaceholder(configPath);
-                    submoduleConfigDir = submoduleConfigDir.replace(/\\/g, '/'); // Use forward slashes, even on Windows
-                    // Configure host includeIf
-                    yield this.git.config(`includeIf.gitdir:${submoduleConfigDir}.path`, credentialsConfigPath, false, false, configPath);
-                    // Configure container includeIf
-                    let relativeSubmoduleConfigDir = path.relative(githubWorkspace, submoduleConfigDir);
-                    relativeSubmoduleConfigDir = relativeSubmoduleConfigDir.replace(/\\/g, '/'); // Use forward slashes, even on Windows
-                    const containerSubmoduleGitDir = path.posix.join('/github/workspace', relativeSubmoduleConfigDir);
-                    yield this.git.config(`includeIf.gitdir:${containerSubmoduleGitDir}.path`, containerCredentialsPath, false, false, configPath);
                 }
                 if (this.settings.sshKey) {
                     // Configure core.sshCommand
@@ -402,23 +385,27 @@ class GitAuthHelper {
                 yield this.git.config('include.path', credentialsConfigPath, true);
             }
             else {
-                // Host git directory
+                // For local config, use includeIf.gitdir to match the .git directory.
+                // Configure for both host and container paths to support Docker container actions.
                 let gitDir = path.join(this.git.getWorkingDirectory(), '.git');
-                gitDir = gitDir.replace(/\\/g, '/'); // Use forward slashes, even on Windows
+                console.log(`Git dir: ${gitDir}`);
-                // Configure host includeIf
+                core.info(`Git dir: ${gitDir}`);
+                // Use forward slashes for git config, even on Windows
+                gitDir = gitDir.replace(/\\/g, '/');
                 const hostIncludeKey = `includeIf.gitdir:${gitDir}.path`;
                 yield this.git.config(hostIncludeKey, credentialsConfigPath);
                 this.credentialsIncludeKeys.push(hostIncludeKey);
-                // Container git directory
+                // Configure for container scenario where paths are mapped to fixed locations
                 const githubWorkspace = process.env['GITHUB_WORKSPACE'];
                 assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined');
+                // Calculate the relative path of the working directory from GITHUB_WORKSPACE
                 const workingDirectory = this.git.getWorkingDirectory();
                 let relativePath = path.relative(githubWorkspace, workingDirectory);
-                relativePath = relativePath.replace(/\\/g, '/'); // Use forward slashes, even on Windows
+                // Container paths: GITHUB_WORKSPACE -> /github/workspace, RUNNER_TEMP -> /github/runner_temp
+                // Use forward slashes for git config
+                relativePath = relativePath.replace(/\\/g, '/');
                 const containerGitDir = path.posix.join('/github/workspace', relativePath, '.git');
-                // Container credentials config path
                 const containerCredentialsPath = path.posix.join('/github/runner_temp', path.basename(credentialsConfigPath));
-                // Configure container includeIf
                 const containerIncludeKey = `includeIf.gitdir:${containerGitDir}.path`;
                 yield this.git.config(containerIncludeKey, containerCredentialsPath);
                 this.credentialsIncludeKeys.push(containerIncludeKey);
@@ -465,22 +452,18 @@ class GitAuthHelper {
             }
             // SSH command
             yield this.removeGitConfig(SSH_COMMAND_KEY);
-            yield this.removeSubmoduleGitConfig(SSH_COMMAND_KEY);
         });
     }
     removeToken() {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
-            // Remove HTTP extra header
+            // HTTP extra header
             yield this.removeGitConfig(this.tokenConfigKey);
-            yield this.removeSubmoduleGitConfig(this.tokenConfigKey);
+            // Remove include/includeIf config entries
-            // Remove includeIf
             for (const includeKey of this.credentialsIncludeKeys) {
                 yield this.removeGitConfig(includeKey);
             }
             this.credentialsIncludeKeys = [];
-            // Remove submodule includeIf
-            yield this.git.submoduleForeach(`sh -c "git config --local --get-regexp '^includeIf\\.' && git config --local --remove-section includeIf || :"`, true);
             // Remove credentials config file
             if (this.credentialsConfigPath) {
                 try {
@@ -493,20 +476,18 @@ class GitAuthHelper {
             }
         });
     }
-    removeGitConfig(configKey) {
+    removeGitConfig(configKey_1) {
-        return __awaiter(this, void 0, void 0, function* () {
+        return __awaiter(this, arguments, void 0, function* (configKey, submoduleOnly = false) {
-            if ((yield this.git.configExists(configKey)) &&
+            if (!submoduleOnly) {
-                !(yield this.git.tryConfigUnset(configKey))) {
+                if ((yield this.git.configExists(configKey)) &&
-                // Load the config contents
+                    !(yield this.git.tryConfigUnset(configKey))) {
-                core.warning(`Failed to remove '${configKey}' from the git config`);
+                    // Load the config contents
+                    core.warning(`Failed to remove '${configKey}' from the git config`);
+                }
             }
-        });
-    }
-    removeSubmoduleGitConfig(configKey) {
-        return __awaiter(this, void 0, void 0, function* () {
             const pattern = regexpHelper.escape(configKey);
             yield this.git.submoduleForeach(
-            // Wrap the pipeline in quotes to make sure it's handled properly by submoduleForeach, rather than just the first part of the pipeline.
+            // wrap the pipeline in quotes to make sure it's handled properly by submoduleForeach, rather than just the first part of the pipeline
             `sh -c "git config --local --name-only --get-regexp '${pattern}' && git config --local --unset-all '${configKey}' || :"`, true);
         });
     }

src/git-auth-helper.ts

@@ -44,7 +44,7 @@ class GitAuthHelper {
   private sshKnownHostsPath = ''
   private temporaryHomePath = ''
   private credentialsConfigPath = '' // Path to separate credentials config file in RUNNER_TEMP
-  private credentialsIncludeKeys: string[] = [] // Track includeIf config keys for cleanup
+  private credentialsIncludeKeys: string[] = [] // Track includeIf/include config keys for cleanup
 
   constructor(
     gitCommandManager: IGitCommandManager,
@@ -168,76 +168,26 @@ class GitAuthHelper {
 
   async configureSubmoduleAuth(): Promise<void> {
     // Remove possible previous HTTPS instead of SSH
-    await this.removeSubmoduleGitConfig(this.insteadOfKey)
+    await this.removeGitConfig(this.insteadOfKey, true)
 
     if (this.settings.persistCredentials) {
-      // Credentials config path
+      // TODO: UPDATE THIS
-      const credentialsConfigPath = await this.getCredentialsConfigPath()
 
-      // Container credentials config path
+      // Configure a placeholder value. This approach avoids the credential being captured
-      const containerCredentialsPath = path.posix.join(
+      // by process creation audit events, which are commonly logged. For more information,
-        '/github/runner_temp',
+      // refer to https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing
-        path.basename(credentialsConfigPath)
-      )
-
-      // Container repo path
-      const workingDirectory = this.git.getWorkingDirectory()
-      const githubWorkspace = process.env['GITHUB_WORKSPACE']
-      assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined')
-      let relativePath = path.relative(githubWorkspace, workingDirectory)
-      relativePath = relativePath.replace(/\\/g, '/')
-      const containerRepoPath = path.posix.join(
-        '/github/workspace',
-        relativePath
-      )
-
-      // Get submodule config file paths.
-      // Use `--show-origin` to get the config file path for each submodule.
       const output = await this.git.submoduleForeach(
-        `git config --local --show-origin --name-only --get-regexp remote.origin.url`,
+        // Wrap the pipeline in quotes to make sure it's handled properly by submoduleForeach, rather than just the first part of the pipeline
+        `sh -c "git config --local '${this.tokenConfigKey}' '${this.tokenPlaceholderConfigValue}' && git config --local --show-origin --name-only --get-regexp remote.origin.url"`,
         this.settings.nestedSubmodules
       )
 
-      // Extract config file paths from the output (lines starting with "file:").
+      // Replace the placeholder
-      const configPaths =
+      const configPaths: string[] =
         output.match(/(?<=(^|\n)file:)[^\t]+(?=\tremote\.origin\.url)/g) || []
-
-      // For each submodule, configure includeIf entries pointing to the shared credentials file.
-      // Configure both host and container paths to support Docker container actions.
       for (const configPath of configPaths) {
-        // The config file is at .git/modules/submodule-name/config
+        core.debug(`Replacing token placeholder in '${configPath}'`)
-        let submoduleConfigDir = path.dirname(configPath)
+        await this.replaceTokenPlaceholder(configPath)
-        submoduleConfigDir = submoduleConfigDir.replace(/\\/g, '/') // Use forward slashes, even on Windows
-
-        // Configure host includeIf
-        await this.git.config(
-          `includeIf.gitdir:${submoduleConfigDir}.path`,
-          credentialsConfigPath,
-          false,
-          false,
-          configPath
-        )
-
-        // Configure container includeIf
-        let relativeSubmoduleConfigDir = path.relative(
-          githubWorkspace,
-          submoduleConfigDir
-        )
-        relativeSubmoduleConfigDir = relativeSubmoduleConfigDir.replace(
-          /\\/g,
-          '/'
-        ) // Use forward slashes, even on Windows
-        const containerSubmoduleGitDir = path.posix.join(
-          '/github/workspace',
-          relativeSubmoduleConfigDir
-        )
-        await this.git.config(
-          `includeIf.gitdir:${containerSubmoduleGitDir}.path`,
-          containerCredentialsPath,
-          false,
-          false,
-          configPath
-        )
       }
 
       if (this.settings.sshKey) {
@@ -366,34 +316,38 @@ class GitAuthHelper {
       // Global config file is temporary
       await this.git.config('include.path', credentialsConfigPath, true)
     } else {
-      // Host git directory
+      // For local config, use includeIf.gitdir to match the .git directory.
+      // Configure for both host and container paths to support Docker container actions.
       let gitDir = path.join(this.git.getWorkingDirectory(), '.git')
-      gitDir = gitDir.replace(/\\/g, '/') // Use forward slashes, even on Windows
+      console.log(`Git dir: ${gitDir}`)
-
+      core.info(`Git dir: ${gitDir}`)
-      // Configure host includeIf
+      // Use forward slashes for git config, even on Windows
+      gitDir = gitDir.replace(/\\/g, '/')
       const hostIncludeKey = `includeIf.gitdir:${gitDir}.path`
       await this.git.config(hostIncludeKey, credentialsConfigPath)
       this.credentialsIncludeKeys.push(hostIncludeKey)
 
-      // Container git directory
+      // Configure for container scenario where paths are mapped to fixed locations
       const githubWorkspace = process.env['GITHUB_WORKSPACE']
       assert.ok(githubWorkspace, 'GITHUB_WORKSPACE is not defined')
+      
+      // Calculate the relative path of the working directory from GITHUB_WORKSPACE
       const workingDirectory = this.git.getWorkingDirectory()
       let relativePath = path.relative(githubWorkspace, workingDirectory)
-      relativePath = relativePath.replace(/\\/g, '/') // Use forward slashes, even on Windows
+
+      // Container paths: GITHUB_WORKSPACE -> /github/workspace, RUNNER_TEMP -> /github/runner_temp
+      // Use forward slashes for git config
+      relativePath = relativePath.replace(/\\/g, '/')
       const containerGitDir = path.posix.join(
         '/github/workspace',
         relativePath,
         '.git'
       )
-
-      // Container credentials config path
       const containerCredentialsPath = path.posix.join(
         '/github/runner_temp',
         path.basename(credentialsConfigPath)
       )
 
-      // Configure container includeIf
       const containerIncludeKey = `includeIf.gitdir:${containerGitDir}.path`
       await this.git.config(containerIncludeKey, containerCredentialsPath)
       this.credentialsIncludeKeys.push(containerIncludeKey)
@@ -443,26 +397,18 @@ class GitAuthHelper {
 
     // SSH command
     await this.removeGitConfig(SSH_COMMAND_KEY)
-    await this.removeSubmoduleGitConfig(SSH_COMMAND_KEY)
   }
 
   private async removeToken(): Promise<void> {
-    // Remove HTTP extra header
+    // HTTP extra header
     await this.removeGitConfig(this.tokenConfigKey)
-    await this.removeSubmoduleGitConfig(this.tokenConfigKey)
 
-    // Remove includeIf
+    // Remove include/includeIf config entries
     for (const includeKey of this.credentialsIncludeKeys) {
       await this.removeGitConfig(includeKey)
     }
     this.credentialsIncludeKeys = []
 
-    // Remove submodule includeIf
-    await this.git.submoduleForeach(
-      `sh -c "git config --local --get-regexp '^includeIf\\.' && git config --local --remove-section includeIf || :"`,
-      true
-    )
-
     // Remove credentials config file
     if (this.credentialsConfigPath) {
       try {
@@ -476,20 +422,23 @@ class GitAuthHelper {
     }
   }
 
-  private async removeGitConfig(configKey: string): Promise<void> {
+  private async removeGitConfig(
-    if (
+    configKey: string,
-      (await this.git.configExists(configKey)) &&
+    submoduleOnly: boolean = false
-      !(await this.git.tryConfigUnset(configKey))
+  ): Promise<void> {
-    ) {
+    if (!submoduleOnly) {
-      // Load the config contents
+      if (
-      core.warning(`Failed to remove '${configKey}' from the git config`)
+        (await this.git.configExists(configKey)) &&
+        !(await this.git.tryConfigUnset(configKey))
+      ) {
+        // Load the config contents
+        core.warning(`Failed to remove '${configKey}' from the git config`)
+      }
     }
-  }
 
-  private async removeSubmoduleGitConfig(configKey: string): Promise<void> {
     const pattern = regexpHelper.escape(configKey)
     await this.git.submoduleForeach(
-      // Wrap the pipeline in quotes to make sure it's handled properly by submoduleForeach, rather than just the first part of the pipeline.
+      // wrap the pipeline in quotes to make sure it's handled properly by submoduleForeach, rather than just the first part of the pipeline
       `sh -c "git config --local --name-only --get-regexp '${pattern}' && git config --local --unset-all '${configKey}' || :"`,
       true
     )