Make KUBECONFIG filename predictable

README.md

@@ -16,6 +16,15 @@ This action requires:
     runners, you must use runner version [2.285.0](https://github.com/actions/virtual-environments)
     or newer.
 
+-   If you plan to create binaries, containers, pull requests, or other
+    releases, add the following to your .gitignore to prevent accidentially
+    committing the KUBECONFIG to your release artifact:
+
+    ```text
+    # Ignore generated kubeconfig from google-github-actions/get-gke-credentials
+    gha-kubeconfig-*
+    ```
+
 ## Usage
 
 ```yaml
@@ -83,7 +92,11 @@ jobs:
 
 ## Outputs
 
-- Exports env var `KUBECONFIG` which is set to the generated `kubeconfig` file path.
+-   `kubeconfig_path` - Path on the local filesystem where the generated
+    KUBECONFIG file resides.
+
+-   Exports env var `KUBECONFIG` which is set to the generated `kubeconfig` file
+    path.
 
 ## Authorization
 

action.yaml

@@ -84,6 +84,11 @@ inputs:
       advanced setting, most users should leave this blank.
     required: false
 
+outputs:
+  kubeconfig_path:
+    description: |-
+      Path on the local filesystem where the generated KUBECONFIG file resides.
+
 branding:
   icon: 'lock'
   color: 'blue'

src/main.ts

@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 
+import { join as pathjoin } from 'path';
+
 import {
   exportVariable,
   getInput,
@@ -25,6 +27,7 @@ import {
   errorMessage,
   parseBoolean,
   presence,
+  randomFilename,
   randomFilepath,
   writeSecureFile,
 } from '@google-github-actions/actions-utils';
@@ -53,8 +56,8 @@ async function run(): Promise<void> {
     }
 
     // Ensure a workspace is set.
-    const workspace = process.env.GITHUB_WORKSPACE;
-    if (!workspace) {
+    const githubWorkspace = process.env.GITHUB_WORKSPACE;
+    if (!githubWorkspace) {
       throw new Error('$GITHUB_WORKSPACE is not set');
     }
 
@@ -130,7 +133,11 @@ async function run(): Promise<void> {
 
     // Write kubeconfig to disk
     try {
-      const kubeConfigPath = await writeSecureFile(randomFilepath(workspace), kubeConfig);
+      const filename = 'gha-kubeconfig-' + randomFilename(8);
+      const kubeConfigPath = pathjoin(githubWorkspace, filename);
+      logDebug(`Creating KUBECONFIG at ${kubeConfigPath}`);
+      await writeSecureFile(kubeConfigPath, kubeConfig);
+
       exportVariable('KUBECONFIG', kubeConfigPath);
       exportVariable('KUBE_CONFIG_PATH', kubeConfigPath);
       logInfo(`Successfully created and exported "KUBECONFIG" at: ${kubeConfigPath}`);