fix: clear gh token env vars when switching accounts - #8
Conversation
|
Queued — the merge queue status continues in this comment ↓. |
Merge Queue Status
This pull request spent 19 seconds in the queue, including 2 seconds running CI. Required conditions to merge |
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| const result = await $({ reject: false })`gh auth status --hostname ${hostname}`; | ||
| const result = await $({ | ||
| reject: false, | ||
| env: envWithoutGhTokens(), |
There was a problem hiding this comment.
WARNING: Stripping token env vars in getAuthStatus affects the non-switch-account path too
Because getAuthStatus is also used by the default (switch-account: false) flow at the else if ((await getAuthStatus(hostname)).ok) branch, removing GH_TOKEN/GITHUB_TOKEN from the probe is not scoped to switch-account. Previously, when a workflow provided a token input and had GH_TOKEN set in the environment, gh auth status succeeded via that env token and the action skipped login. Now the stripped probe sees no stored auth on a fresh runner, fails, and the action falls through to loginWithToken, which persists the provided token to the resolved config dir (the global $HOME/.config/gh when not switching). This can overwrite previously stored credentials on self-hosted/persistent runners and is a behavior change not exercised by the added tests. Consider scoping the env-stripping to the switch-account path, or document that the default path now writes the provided token to the user's gh config.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| core.exportVariable("GH_CONFIG_DIR", ghConfigDir); | ||
| await loginWithToken(hostname, token); | ||
| core.exportVariable("GH_TOKEN", token); | ||
| clearGhTokenEnvForHost(hostname); |
There was a problem hiding this comment.
WARNING: switch-account no longer exports GH_TOKEN and also clears GITHUB_TOKEN
Two behavior changes from replacing core.exportVariable("GH_TOKEN", token) with clearGhTokenEnvForHost(hostname): (1) Workflows that previously relied on $GH_TOKEN being exported by this action after switch-account: true will now find it empty — a breaking change for existing consumers. (2) clearGhTokenEnvForHost sets both GH_TOKEN and GITHUB_TOKEN (or the enterprise equivalents) to "", which clobbers any job/workflow-level GITHUB_TOKEN/GITHUB_ENTERPRISE_TOKEN that subsequent non-gh steps may depend on, with no opt-out. The README/action.yml describe the high-level intent but don't surface these side effects; consider documenting them or verifying intended consumers are unaffected.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: 2 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (5 files)
Fix these issues in Kilo Cloud Reviewed by glm-5.2-short · Input: 47.6K · Output: 17.1K · Cached: 474.5K |
1 participant
Summary
GH_CONFIG_DIRis not shadowed by inherited auth env state.Root cause
gh auth statusand later workflow steps could still seeGH_TOKENorGITHUB_TOKEN, which took precedence over the isolated config directory and made the switched account look inconsistent.References
src/main.ts.github/workflows/test-action.ymlREADME.mdaction.ymlAdditional info
ghcommands now observe the intended isolated account instead of an inherited env token.Testing