Skip to content

fix(pinact): git auth #114

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ReenigneArcher merged 1 commit into from
Feb 3, 2026
Merged

fix(pinact): git auth #114

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
fix(pinact): git auth
  • Loading branch information
@ReenigneArcher
ReenigneArcher committed Feb 3, 2026
commit 42d8ce443cada12024c9cee5340de77862a17b5e
37 changes: 28 additions & 9 deletions actions/pinact/pinact.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,12 +240,18 @@ function configureGit(repoPath, authorName, authorEmail) {
/**
* Create a branch, commit changes, and push
* @param {string} repoPath - Path to the repository
* @param {string} branchName - Name of the branch to create
* @param {string} authorName - Git author name
* @param {string} authorEmail - Git author email
* @param {boolean} dryRun - Whether this is a dry run
* @param {Object} options - Commit and push options
* @param {string} options.branchName - Name of the branch to create
* @param {string} options.authorName - Git author name
* @param {string} options.authorEmail - Git author email
* @param {boolean} options.dryRun - Whether this is a dry run
* @param {string} options.owner - Repository owner
* @param {string} options.repo - Repository name
* @param {string} options.token - GitHub token for authentication
*/
function commitAndPush(repoPath, branchName, authorName, authorEmail, dryRun) {
function commitAndPush(repoPath, options) {
const { branchName, authorName, authorEmail, dryRun, owner, repo, token } = options;

Logger.log('Creating branch and committing changes...');

configureGit(repoPath, authorName, authorEmail);
Expand All @@ -264,8 +270,12 @@ function commitAndPush(repoPath, branchName, authorName, authorEmail, dryRun) {
Logger.info('🔍 DRY RUN: Would push to branch: ' + branchName + ' (skipping)');
Logger.log('');
} else {
// Set remote URL with token to ensure authentication works
const repoUrl = 'https://x-access-token:' + token + '@github.com/' + owner + '/' + repo + '.git';
execCommand('git remote set-url origin ' + repoUrl, { cwd: repoPath });

// Push branch
execCommand('git push origin ' + branchName, { cwd: repoPath });
execCommand('git push -u origin ' + branchName, { cwd: repoPath });
Logger.success('✅ Changes committed and pushed to branch: ' + branchName);
Logger.log('');
}
Expand Down Expand Up @@ -328,7 +338,8 @@ async function createPullRequest(github, owner, repo, branchName, defaultBranch,
const title = 'chore: update GitHub Actions to use commit hashes';
const body = `This PR updates GitHub Actions to use commit hashes instead of tags for improved security.

Changes were automatically generated by [pinact](https://github.com/suzuki-shunsuke/pinact).
Changes were automatically generated by [pinact](https://github.com/suzuki-shunsuke/pinact)
and the LizardByte/actions [pinact action](https://github.com/LizardByte/actions/tree/master/actions/pinact).

## Benefits
- Prevents tag hijacking attacks
Expand Down Expand Up @@ -489,7 +500,15 @@ async function processRepository(github, options) {

if (hasChanges) {
// Commit and push changes
commitAndPush(repoPath, branchName, authorName, authorEmail, dryRun);
commitAndPush(repoPath, {
branchName,
authorName,
authorEmail,
dryRun,
owner,
repo,
token
});

// Create pull request
await createPullRequest(github, owner, repo, branchName, defaultBranch, dryRun);
Expand Down Expand Up @@ -735,7 +754,7 @@ async function runPinactAction({ github, context, core }) {
const pinactVersion = process.env.INPUT_PINACT_VERSION;
const prBranchName = process.env.INPUT_PR_BRANCH_NAME;
const repo = process.env.INPUT_REPO;
const token = process.env.GITHUB_TOKEN || process.env.INPUT_TOKEN;
const token = process.env.PINACT_GITHUB_TOKEN || process.env.INPUT_TOKEN || process.env.GITHUB_TOKEN;

printActionConfig({
dryRun,
Expand Down