TestCheckoutPushTokenFallback verifies the safe_outputs push-token fallback that persists the resolved PR push token into the checkout when keepCredentialsForPush is enabled and no explicit checkout token (or app auth) already governs the checkout.
(t *testing.T)
| 238 | // persists the resolved PR push token into the checkout when keepCredentialsForPush is |
| 239 | // enabled and no explicit checkout token (or app auth) already governs the checkout. |
| 240 | func TestCheckoutPushTokenFallback(t *testing.T) { |
| 241 | getPin := func(action string) string { return action + "@v4" } |
| 242 | const pushToken = "${{ secrets.PUSH_TOKEN }}" |
| 243 | |
| 244 | t.Run("default checkout with no explicit token emits pushToken once", func(t *testing.T) { |
| 245 | cm := NewCheckoutManager(nil) |
| 246 | cm.SetKeepCredentialsForPush(true) |
| 247 | cm.SetPushToken(pushToken) |
| 248 | lines := cm.GenerateDefaultCheckoutStep(false, "", getPin) |
| 249 | combined := strings.Join(lines, "") |
| 250 | assert.Contains(t, combined, "persist-credentials: true", "keepCredentialsForPush should retain credentials") |
| 251 | assert.Contains(t, combined, "token: "+pushToken, "should persist the push token") |
| 252 | assert.Equal(t, 1, strings.Count(combined, "token: "), "token must be emitted exactly once") |
| 253 | }) |
| 254 | |
| 255 | t.Run("default checkout with explicit token does not override with pushToken", func(t *testing.T) { |
| 256 | cm := NewCheckoutManager([]*CheckoutConfig{ |
| 257 | {GitHubToken: "${{ secrets.MY_TOKEN }}"}, |
| 258 | }) |
| 259 | cm.SetKeepCredentialsForPush(true) |
| 260 | cm.SetPushToken(pushToken) |
| 261 | lines := cm.GenerateDefaultCheckoutStep(false, "", getPin) |
| 262 | combined := strings.Join(lines, "") |
| 263 | assert.Contains(t, combined, "token: ${{ secrets.MY_TOKEN }}", "explicit checkout token should win") |
| 264 | assert.NotContains(t, combined, pushToken, "pushToken must not override an explicit checkout token") |
| 265 | assert.Equal(t, 1, strings.Count(combined, "token: "), "token must be emitted exactly once") |
| 266 | }) |
| 267 | |
| 268 | t.Run("default checkout with app auth does not override with pushToken", func(t *testing.T) { |
| 269 | cm := NewCheckoutManager([]*CheckoutConfig{ |
| 270 | {GitHubApp: &GitHubAppConfig{AppID: "${{ vars.APP_ID }}", PrivateKey: "${{ secrets.APP_KEY }}"}}, |
| 271 | }) |
| 272 | cm.SetKeepCredentialsForPush(true) |
| 273 | cm.SetPushToken(pushToken) |
| 274 | lines := cm.GenerateDefaultCheckoutStep(false, "", getPin) |
| 275 | combined := strings.Join(lines, "") |
| 276 | assert.Contains(t, combined, "checkout-app-token-0.outputs.token", "app-minted token should govern the checkout") |
| 277 | assert.NotContains(t, combined, pushToken, "pushToken must not override an app-minted token") |
| 278 | }) |
| 279 | |
| 280 | t.Run("default checkout does not emit pushToken when keepCredentialsForPush is false", func(t *testing.T) { |
| 281 | cm := NewCheckoutManager(nil) |
| 282 | cm.SetPushToken(pushToken) |
| 283 | lines := cm.GenerateDefaultCheckoutStep(false, "", getPin) |
| 284 | combined := strings.Join(lines, "") |
| 285 | assert.Contains(t, combined, "persist-credentials: false", "agent-style checkout strips credentials") |
| 286 | assert.NotContains(t, combined, pushToken, "pushToken must not be persisted when credentials are not retained") |
| 287 | }) |
| 288 | |
| 289 | t.Run("additional checkout with no token uses pushToken", func(t *testing.T) { |
| 290 | cm := NewCheckoutManager([]*CheckoutConfig{ |
| 291 | {Repository: "owner/libs", Path: "./libs"}, |
| 292 | }) |
| 293 | cm.SetKeepCredentialsForPush(true) |
| 294 | cm.SetPushToken(pushToken) |
| 295 | lines := cm.GenerateAdditionalCheckoutSteps(getPin) |
| 296 | combined := strings.Join(lines, "") |
| 297 | assert.Contains(t, combined, "persist-credentials: true", "keepCredentialsForPush should retain credentials") |
nothing calls this directly
no test coverage detected