Skip to content

Commit 990bd73

Browse files
babblebeybabblebey
authoredSep 5, 2024··
fix: Revert: feat: verify OAuth scopes of classic GitHub PATs (#915)
·
v11.0.1v10.3.3
1 parent 4393578 commit 990bd73

File tree

4 files changed

+19
-420
lines changed

4 files changed

+19
-420
lines changed
 

‎lib/definitions/errors.js

+3-15
Original file line numberDiff line numberDiff line change
@@ -178,24 +178,12 @@ If you are using [GitHub Enterprise](https://enterprise.github.com) please make
178178

179179
export function EGHNOPERMISSION({ owner, repo }) {
180180
return {
181-
message: `The GitHub token doesn't allow to push to and maintain the repository ${owner}/${repo}.`,
181+
message: `The GitHub token doesn't allow to push on the repository ${owner}/${repo}.`,
182182
details: `The user associated with the [GitHub token](${linkify(
183183
"README.md#github-authentication",
184-
)}) configured in the \`GH_TOKEN\` or \`GITHUB_TOKEN\` environment variable must have permission to push to and maintain the repository ${owner}/${repo}.
184+
)}) configured in the \`GH_TOKEN\` or \`GITHUB_TOKEN\` environment variable must allows to push to the repository ${owner}/${repo}.
185185
186-
Please make sure the GitHub user associated with the token is an [owner](https://help.github.com/articles/permission-levels-for-a-user-account-repository/#owner-access-on-a-repository-owned-by-a-user-account) or a [collaborator](https://help.github.com/articles/permission-levels-for-a-user-account-repository/#collaborator-access-on-a-repository-owned-by-a-user-account) if the repository belongs to a user account or has [write permissions](https://help.github.com/articles/managing-team-access-to-an-organization-repository) if the repository [belongs to an organization](https://help.github.com/articles/repository-permission-levels-for-an-organization).`,
187-
};
188-
}
189-
190-
export function EGHNOSCOPE({ scopes }) {
191-
return {
192-
message: `The GitHub token doesn't have the necessary OAuth scopes to write contents, issues, and pull requests.`,
193-
details: `The [GitHub token](${linkify(
194-
"README.md#github-authentication",
195-
)}) configured in the \`GH_TOKEN\` or \`GITHUB_TOKEN\` environment variable must have the correct scopes.
196-
${scopes ? `\nThe token you used has scopes: ${scopes.join(", ")}\n` : ""}
197-
For classic PATs, make sure the token has the \`repo\` scope if the repository is private, or \`public_repo\` scope otherwise.
198-
For fine-grained PATs, make sure the token has the \`content: write\`, \`issues: write\`, and \`pull_requests: write\` scopes on the repository.`,
186+
Please make sure the GitHub user associated with the token is an [owner](https://help.github.com/articles/permission-levels-for-a-user-account-repository/#owner-access-on-a-repository-owned-by-a-user-account) or a [collaborator](https://help.github.com/articles/permission-levels-for-a-user-account-repository/#collaborator-access-on-a-repository-owned-by-a-user-account) if the repository belong to a user account or has [write permissions](https://help.github.com/articles/managing-team-access-to-an-organization-repository) if the repository [belongs to an organization](https://help.github.com/articles/repository-permission-levels-for-an-organization).`,
199187
};
200188
}
201189

‎lib/verify.js

+2-15
Original file line numberDiff line numberDiff line change
@@ -107,21 +107,8 @@ export default async function verify(pluginConfig, context, { Octokit }) {
107107
);
108108
try {
109109
const {
110-
headers,
111-
data: { private: _private, permissions, clone_url },
110+
data: { permissions, clone_url },
112111
} = await octokit.request("GET /repos/{owner}/{repo}", { repo, owner });
113-
114-
// GitHub only returns this header if the token is a classic PAT
115-
if (headers?.["x-oauth-scopes"]) {
116-
const scopes = headers["x-oauth-scopes"].split(/\s*,\s*/g);
117-
if (
118-
!scopes.includes("repo") &&
119-
(_private || !scopes.includes("public_repo"))
120-
) {
121-
errors.push(getError("EGHNOSCOPE", { scopes }));
122-
}
123-
}
124-
125112
// Verify if Repository Name wasn't changed
126113
const parsedCloneUrl = parseGithubUrl(clone_url);
127114
if (
@@ -137,7 +124,7 @@ export default async function verify(pluginConfig, context, { Octokit }) {
137124
// Do not check for permissions in GitHub actions, as the provided token is an installation access token.
138125
// octokit.request("GET /repos/{owner}/{repo}", {repo, owner}) does not return the "permissions" key in that case.
139126
// But GitHub Actions have all permissions required for @semantic-release/github to work
140-
if (!env.GITHUB_ACTION && !(permissions?.push && permissions?.maintain)) {
127+
if (!env.GITHUB_ACTION && !permissions?.push) {
141128
// If authenticated as GitHub App installation, `push` will always be false.
142129
// We send another request to check if current authentication is an installation.
143130
// Note: we cannot check if the installation has all required permissions, it's

‎test/integration.test.js

+5-63
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ test("Verify GitHub auth", async (t) => {
2929
.getOnce(`https://api.github.local/repos/${owner}/${repo}`, {
3030
permissions: {
3131
push: true,
32-
maintain: true,
3332
},
3433
clone_url: `https://api.github.local/${owner}/${repo}.git`,
3534
});
@@ -50,43 +49,6 @@ test("Verify GitHub auth", async (t) => {
5049
t.true(fetch.done());
5150
});
5251

53-
test("Throws when GitHub user lacks maintain permission", async (t) => {
54-
const owner = "test_user";
55-
const repo = "test_repo";
56-
const env = { GITHUB_TOKEN: "github_token" };
57-
const options = {
58-
repositoryUrl: `git+https://othertesturl.com/${owner}/${repo}.git`,
59-
};
60-
61-
const fetch = fetchMock
62-
.sandbox()
63-
.getOnce(`https://api.github.local/repos/${owner}/${repo}`, {
64-
permissions: {
65-
push: true,
66-
maintain: false,
67-
},
68-
clone_url: `https://api.github.local/${owner}/${repo}.git`,
69-
});
70-
71-
const {
72-
errors: [error],
73-
} = await t.throwsAsync(
74-
t.context.m.verifyConditions(
75-
{},
76-
{ cwd, env, options, logger: t.context.logger },
77-
{
78-
Octokit: TestOctokit.defaults((options) => ({
79-
...options,
80-
request: { ...options.request, fetch },
81-
})),
82-
},
83-
),
84-
);
85-
86-
t.is(error.code, "EGHNOPERMISSION");
87-
t.true(fetch.done());
88-
});
89-
9052
test("Verify GitHub auth with publish options", async (t) => {
9153
const owner = "test_user";
9254
const repo = "test_repo";
@@ -100,7 +62,6 @@ test("Verify GitHub auth with publish options", async (t) => {
10062
.get(`https://api.github.local/repos/${owner}/${repo}`, {
10163
permissions: {
10264
push: true,
103-
maintain: true,
10465
},
10566
clone_url: `https://api.github.local/${owner}/${repo}.git`,
10667
});
@@ -141,7 +102,6 @@ test("Verify GitHub auth and assets config", async (t) => {
141102
.getOnce(`https://api.github.local/repos/${owner}/${repo}`, {
142103
permissions: {
143104
push: true,
144-
maintain: true,
145105
},
146106
clone_url: `https://api.github.local/${owner}/${repo}.git`,
147107
});
@@ -248,7 +208,6 @@ test("Publish a release with an array of assets", async (t) => {
248208
.getOnce(`https://api.github.local/repos/${owner}/${repo}`, {
249209
permissions: {
250210
push: true,
251-
maintain: true,
252211
},
253212
clone_url: `https://api.github.local/${owner}/${repo}.git`,
254213
})
@@ -344,7 +303,6 @@ test("Publish a release with release information in assets", async (t) => {
344303
.getOnce(`https://api.github.local/repos/${owner}/${repo}`, {
345304
permissions: {
346305
push: true,
347-
maintain: true,
348306
},
349307
clone_url: `https://api.github.local/${owner}/${repo}.git`,
350308
})
@@ -418,7 +376,6 @@ test("Update a release", async (t) => {
418376
.getOnce(`https://api.github.local/repos/${owner}/${repo}`, {
419377
permissions: {
420378
push: true,
421-
maintain: true,
422379
},
423380
clone_url: `https://api.github.local/${owner}/${repo}.git`,
424381
})
@@ -485,10 +442,7 @@ test("Comment and add labels on PR included in the releases", async (t) => {
485442
.get(
486443
`https://api.github.local/repos/${owner}/${repo}`,
487444
{
488-
permissions: {
489-
push: true,
490-
maintain: true,
491-
},
445+
permissions: { push: true },
492446
full_name: `${owner}/${repo}`,
493447
clone_url: `htttps://api.github.local/${owner}/${repo}.git`,
494448
},
@@ -596,10 +550,7 @@ test("Open a new issue with the list of errors", async (t) => {
596550
.get(
597551
`https://api.github.local/repos/${owner}/${repo}`,
598552
{
599-
permissions: {
600-
push: true,
601-
maintain: true,
602-
},
553+
permissions: { push: true },
603554
full_name: `${owner}/${repo}`,
604555
clone_url: `htttps://api.github.local/${owner}/${repo}.git`,
605556
},
@@ -694,10 +645,7 @@ test("Verify, release and notify success", async (t) => {
694645
.get(
695646
`https://api.github.local/repos/${owner}/${repo}`,
696647
{
697-
permissions: {
698-
push: true,
699-
maintain: true,
700-
},
648+
permissions: { push: true },
701649
full_name: `${owner}/${repo}`,
702650
clone_url: `htttps://api.github.local/${owner}/${repo}.git`,
703651
},
@@ -863,10 +811,7 @@ test("Verify, update release and notify success", async (t) => {
863811
.get(
864812
`https://api.github.local/repos/${owner}/${repo}`,
865813
{
866-
permissions: {
867-
push: true,
868-
maintain: true,
869-
},
814+
permissions: { push: true },
870815
full_name: `${owner}/${repo}`,
871816
clone_url: `htttps://api.github.local/${owner}/${repo}.git`,
872817
},
@@ -1004,10 +949,7 @@ test("Verify and notify failure", async (t) => {
1004949
.get(
1005950
`https://api.github.local/repos/${owner}/${repo}`,
1006951
{
1007-
permissions: {
1008-
push: true,
1009-
maintain: true,
1010-
},
952+
permissions: { push: true },
1011953
full_name: `${owner}/${repo}`,
1012954
clone_url: `htttps://api.github.local/${owner}/${repo}.git`,
1013955
},

‎test/verify.test.js

+9-327
Large diffs are not rendered by default.

0 commit comments

Comments
 (0)
Please sign in to comment.