81 lines
2.2 KiB
TypeScript
81 lines
2.2 KiB
TypeScript
const STATIC_GITHUB_CREDENTIAL_ENVIRONMENT_KEYS = [
|
|
"PAPERCLIP_RUNNER_NETWORK_ACCESS",
|
|
"PAPERCLIP_RUNNER_NETWORK_ROOTS",
|
|
"PAPERCLIP_GITHUB_AUTH_MODE",
|
|
"PAPERCLIP_GITHUB_HOST_HOME",
|
|
"PAPERCLIP_GIT_METADATA_ROOTS",
|
|
"ZDOTDIR",
|
|
"BASH_ENV",
|
|
"PAPERCLIP_GITHUB_BRIDGE_TOKEN",
|
|
"PAPERCLIP_GITHUB_BROKER_URL",
|
|
"PAPERCLIP_GITHUB_BROKER_TOKEN",
|
|
"PAPERCLIP_GITHUB_LAUNCHER_DIR",
|
|
"GH_CONFIG_DIR",
|
|
"GH_ENTERPRISE_TOKEN",
|
|
"GITHUB_ENTERPRISE_TOKEN",
|
|
"GIT_CONFIG_GLOBAL",
|
|
"GIT_CONFIG_SYSTEM",
|
|
"GIT_CONFIG_NOSYSTEM",
|
|
"GIT_ASKPASS",
|
|
"SSH_ASKPASS",
|
|
"SSH_AUTH_SOCK",
|
|
"GIT_SSH_COMMAND",
|
|
"GIT_SSH",
|
|
"GH_TOKEN",
|
|
"GITHUB_TOKEN",
|
|
"PAPERCLIP_GIT_TOKEN",
|
|
"GIT_TERMINAL_PROMPT",
|
|
"GIT_CONFIG_COUNT",
|
|
"GIT_AUTHOR_NAME",
|
|
"GIT_AUTHOR_EMAIL",
|
|
"GIT_COMMITTER_NAME",
|
|
"GIT_COMMITTER_EMAIL",
|
|
] as const;
|
|
|
|
const MAX_GIT_CONFIG_ENTRIES = 32;
|
|
|
|
function gitConfigCount(source: NodeJS.ProcessEnv): number | null {
|
|
const raw = source.GIT_CONFIG_COUNT;
|
|
if (raw === undefined || !/^\d+$/u.test(raw)) return null;
|
|
const count = Number(raw);
|
|
if (!Number.isSafeInteger(count) || count > MAX_GIT_CONFIG_ENTRIES) {
|
|
return null;
|
|
}
|
|
return count;
|
|
}
|
|
|
|
/**
|
|
* Returns the exact controller-projected GitHub environment accepted by the
|
|
* native runner. Dynamic Git config entries are bounded by GIT_CONFIG_COUNT so
|
|
* callers cannot smuggle arbitrary environment variables across the boundary.
|
|
*/
|
|
export function githubCredentialEnvironment(
|
|
source: NodeJS.ProcessEnv,
|
|
): NodeJS.ProcessEnv {
|
|
const environment: NodeJS.ProcessEnv = {};
|
|
for (const key of STATIC_GITHUB_CREDENTIAL_ENVIRONMENT_KEYS) {
|
|
const value = source[key];
|
|
if (value !== undefined) environment[key] = value;
|
|
}
|
|
|
|
const count = gitConfigCount(source);
|
|
if (count === null) {
|
|
delete environment.GIT_CONFIG_COUNT;
|
|
return environment;
|
|
}
|
|
for (let index = 0; index < count; index += 1) {
|
|
for (const prefix of ["GIT_CONFIG_KEY_", "GIT_CONFIG_VALUE_"] as const) {
|
|
const key = `${prefix}${index}`;
|
|
const value = source[key];
|
|
if (value !== undefined) environment[key] = value;
|
|
}
|
|
}
|
|
return environment;
|
|
}
|
|
|
|
export function githubCredentialEnvironmentKeys(
|
|
source: NodeJS.ProcessEnv,
|
|
): string[] {
|
|
return Object.keys(githubCredentialEnvironment(source)).sort();
|
|
}
|