Validate repository org-ownership before storage record creation (#328)

* check if the repository is owned by org before attempting storage record creation Signed-off-by: Meredith Lancaster <malancas@github.com> * linter Signed-off-by: Meredith Lancaster <malancas@github.com> * generate dist Signed-off-by: Meredith Lancaster <malancas@github.com> * add fixtures for repoOwnerIsOrg function Signed-off-by: Meredith Lancaster <malancas@github.com> * formatter Signed-off-by: Meredith Lancaster <malancas@github.com> * clean up fixtures Signed-off-by: Meredith Lancaster <malancas@github.com> * more clean up Signed-off-by: Meredith Lancaster <malancas@github.com> * fix function declaration Signed-off-by: Meredith Lancaster <malancas@github.com> * clean up fixtures Signed-off-by: Meredith Lancaster <malancas@github.com> * add test when repo is not owned by org Signed-off-by: Meredith Lancaster <malancas@github.com> * add more expect statements, clean up mock calls Signed-off-by: Meredith Lancaster <malancas@github.com> * formatter Signed-off-by: Meredith Lancaster <malancas@github.com> * add more spy expect statements Signed-off-by: Meredith Lancaster <malancas@github.com> --------- Signed-off-by: Meredith Lancaster <malancas@github.com>
2026-01-26 08:31:21 -08:00
parent 7433fa7e7a
commit 20eb46ce7a
3 changed files with 98 additions and 12 deletions
@@ -124055,11 +124055,12 @@ var __importStar = (this && this.__importStar) || (function () {
    };
 })();
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.createAttestation = void 0;
+exports.repoOwnerIsOrg = exports.createAttestation = void 0;
 const attest_1 = __nccwpck_require__(11485);
 const oci_1 = __nccwpck_require__(81057);
 const subject_1 = __nccwpck_require__(36303);
 const core = __importStar(__nccwpck_require__(37484));
+const github = __importStar(__nccwpck_require__(93228));
 const OCI_TIMEOUT = 30000;
 const OCI_RETRY = 3;
 const createAttestation = async (subjects, predicate, opts) => {
@@ -124095,6 +124096,14 @@ const createAttestation = async (subjects, predicate, opts) => {
        // attestation process if the token does not have the correct permissions.
        if (opts.createStorageRecord) {
            try {
+                const token = opts.githubToken;
+                const isOrg = await (0, exports.repoOwnerIsOrg)(token);
+                if (!isOrg) {
+                    // The Artifact Metadata Storage Record API is only available to
+                    // organizations. So if the repo owner is not an organization,
+                    // storage record creation should not be attempted.
+                    return result;
+                }
                const registryUrl = getRegistryURL(subject.name);
                const artifactOpts = {
                    name: subject.name,
@@ -124103,7 +124112,7 @@ const createAttestation = async (subjects, predicate, opts) => {
                const packageRegistryOpts = {
                    registryUrl
                };
-                const records = await (0, attest_1.createStorageRecord)(artifactOpts, packageRegistryOpts, opts.githubToken);
+                const records = await (0, attest_1.createStorageRecord)(artifactOpts, packageRegistryOpts, token);
                if (!records || records.length === 0) {
                    core.warning('No storage records were created.');
                }
@@ -124118,6 +124127,18 @@ const createAttestation = async (subjects, predicate, opts) => {
    return result;
 };
 exports.createAttestation = createAttestation;
+// Call the GET /repos/{owner}/{repo} endpoint to determine if the repo
+// owner is an organization. This is used to determine if storage
+// record creation should be attempted.
+const repoOwnerIsOrg = async (githubToken) => {
+    const octokit = github.getOctokit(githubToken);
+    const { data: repo } = await octokit.rest.repos.get({
+        owner: github.context.repo.owner,
+        repo: github.context.repo.repo
+    });
+    return repo.owner?.type === 'Organization';
+};
+exports.repoOwnerIsOrg = repoOwnerIsOrg;
 function getRegistryURL(subjectName) {
    let url;
    try {