@actions/core - npm Package Compare versions

Comparing version 1.5.0 to 1.6.0-beta.0

lib/core.d.ts

@@ -182,1 +182,2 @@ /**
 export declare function getState(name: string): string;
+export declare function getIDToken(aud?: string): Promise<string>;

lib/core.js

@@ -31,3 +31,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getState = exports.saveState = exports.group = exports.endGroup = exports.startGroup = exports.info = exports.notice = exports.warning = exports.error = exports.debug = exports.isDebug = exports.setFailed = exports.setCommandEcho = exports.setOutput = exports.getBooleanInput = exports.getMultilineInput = exports.getInput = exports.addPath = exports.setSecret = exports.exportVariable = exports.ExitCode = void 0;
+exports.getIDToken = exports.getState = exports.saveState = exports.group = exports.endGroup = exports.startGroup = exports.info = exports.notice = exports.warning = exports.error = exports.debug = exports.isDebug = exports.setFailed = exports.setCommandEcho = exports.setOutput = exports.getBooleanInput = exports.getMultilineInput = exports.getInput = exports.addPath = exports.setSecret = exports.exportVariable = exports.ExitCode = void 0;
 const command_1 = require("./command");
@@ -38,2 +38,3 @@ const file_command_1 = require("./file-command");
 const path = __importStar(require("path"));
+const oidc_utils_1 = require("./oidc-utils");
 /**
@@ -307,2 +308,8 @@ * The code to exit an action
 exports.getState = getState;
+function getIDToken(aud) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return yield oidc_utils_1.OidcClient.getIDToken(aud);
+    });
+}
+exports.getIDToken = getIDToken;
 //# sourceMappingURL=core.js.map

package.json

 {
   "name": "@actions/core",
-  "version": "1.5.0",
+  "version": "1.6.0-beta.0",
   "description": "Actions core lib",
@@ -38,2 +38,5 @@ "keywords": [
   },
+  "dependencies": {
+    "@actions/http-client": "^1.0.11"
+  },
   "devDependencies": {
@@ -40,0 +43,0 @@ "@types/node": "^12.0.2"

README.md

@@ -260,1 +260,49 @@ # `@actions/core`
 ```
+
+#### OIDC Token
+
+You can use these methods to interact with the GitHub OIDC provider and get a JWT ID token which would help to get access token from third party cloud providers.
+
+**Method Name**: getIDToken()
+
+**Inputs**
+
+audience : optional
+
+**Outputs**
+
+A [JWT](https://jwt.io/) ID Token
+
+In action's `main.ts`:
+```js
+const core = require('@actions/core');
+async function getIDTokenAction(): Promise<void> {
+  
+   const audience = core.getInput('audience', {required: false})
+   
+   const id_token1 = await core.getIDToken()            // ID Token with default audience
+   const id_token2 = await core.getIDToken(audience)    // ID token with custom audience
+   
+   // this id_token can be used to get access token from third party cloud providers
+}
+getIDTokenAction()
+```
+
+In action's `actions.yml`:
+
+```yaml
+name: 'GetIDToken'
+description: 'Get ID token from Github OIDC provider'
+inputs:
+  audience:  
+    description: 'Audience for which the ID token is intended for'
+    required: false
+outputs:
+  id_token1: 
+    description: 'ID token obtained from OIDC provider'
+  id_token2: 
+    description: 'ID token obtained from OIDC provider'
+runs:
+  using: 'node12'
+  main: 'dist/index.js'
+```

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

48387

increased by17.18%

Number of package files

18

increased by20%

Lines of code

777

increased by13.27%

Number of lines in readme file

307

increased by18.08%

Worsened metrics

Dependency count

1

increased byInfinity%

Number of low quality alerts

1

increased byInfinity%

Number of low supply chain risk alerts

12

increased by20%

Dependency changes

• + Added@actions/http-client@^1.0.11

• + Added@actions/http-client@1.0.11(transitive)

• + Addedtunnel@0.0.6(transitive)