collectSampleRepoTokens walks the workflow's checkout configs and returns a map of "owner/repo" -> token expression so that apply_samples.cjs can pick the right token when calling the GitHub REST API to resolve a PR head ref for a cross-repo sample. The keys are repository slugs as written in the w
(configs []*CheckoutConfig)
| 77 | // declares no auth are omitted; the driver falls back to GITHUB_TOKEN for |
| 78 | // those. |
| 79 | func collectSampleRepoTokens(configs []*CheckoutConfig) map[string]string { |
| 80 | if len(configs) == 0 { |
| 81 | return nil |
| 82 | } |
| 83 | cm := NewCheckoutManager(configs) |
| 84 | tokens := make(map[string]string) |
| 85 | for i, entry := range cm.ordered { |
| 86 | repo := entry.key.repository |
| 87 | if repo == "" { |
| 88 | // The repo slug is unknown at compile time; emit a GitHub Actions |
| 89 | // expression. The Actions runner expands ${{ github.repository }} to |
| 90 | // "owner/repo" before apply_samples.cjs reads GH_AW_REPO_TOKENS, so |
| 91 | // the runtime key matches the slug the driver looks up. |
| 92 | repo = "${{ github.repository }}" |
| 93 | } |
| 94 | var token string |
| 95 | switch { |
| 96 | case entry.githubApp != nil: |
| 97 | //nolint:gosec // G101: GitHub Actions expression template, not a hardcoded credential |
| 98 | token = fmt.Sprintf("${{ steps.checkout-app-token-%d.outputs.token }}", i) |
| 99 | case entry.token != "": |
| 100 | token = entry.token |
| 101 | default: |
| 102 | continue |
| 103 | } |
| 104 | // First-seen wins so the per-repo entry from the user's frontmatter |
| 105 | // takes precedence over later imported configs (CheckoutManager |
| 106 | // already enforces this for merged entries; this guards against |
| 107 | // distinct entries that share a repo but differ in path). |
| 108 | if _, exists := tokens[repo]; !exists { |
| 109 | tokens[repo] = token |
| 110 | } |
| 111 | } |
| 112 | if len(tokens) == 0 { |
| 113 | return nil |
| 114 | } |
| 115 | return tokens |
| 116 | } |
| 117 | |
| 118 | // marshalRepoTokens returns a compact JSON object encoding of m, or nil for |
| 119 | // empty/nil maps so callers can skip emission. encoding/json sorts string- |
no test coverage detected