feat: add proxy support via child process spawning

When proxy environment variables (https_proxy, HTTPS_PROXY, http_proxy,
HTTP_PROXY) are detected and NODE_USE_ENV_PROXY is not already set to
"1", the action spawns a child process with NODE_USE_ENV_PROXY=1 to
enable Node.js native proxy support.

- Add lib/run-with-proxy.js shared utility for both main.js and post.js
- Update main.js and post.js to use runWithProxy() wrapper
- Add tests for proxy spawning, child error handling, and already-enabled path
- 100% code coverage maintained

Co-authored-by: Copilot <[email protected]>

.github/workflows/stale.yml

@@ -0,0 +1,34 @@
+# This workflow warns and then closes issues that have had no activity for a specified amount of time.
+# https://github.com/actions/stale
+
+name: Stale
+
+on:
+  workflow_dispatch:
+  schedule:
+    # 00:00 UTC on Mondays
+    - cron: '0 0 * * 1'
+
+permissions:
+  issues: write
+  pull-requests: write
+
+env:
+  DAYS_BEFORE_STALE: 180
+  DAYS_BEFORE_CLOSE: 60
+  STALE_LABEL: 'stale'
+  STALE_LABEL_URL: ${{github.server_url}}/${{github.repository}}/labels/stale
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v10
+        with:
+          operations-per-run: 100
+          days-before-stale: ${{ env.DAYS_BEFORE_STALE }}
+          days-before-close: ${{ env.DAYS_BEFORE_CLOSE }}
+          stale-issue-label: ${{ env.STALE_LABEL }}
+          stale-pr-label: ${{ env.STALE_LABEL }}
+          stale-issue-message: 'This issue has been marked ${{ env.STALE_LABEL_URL }} because it has been open for ${{ env.DAYS_BEFORE_STALE }} days with no activity. Please close this issue if it is no longer needed. If this issue is still relevant and you would like it to remain open, simply update it within the next ${{ env.DAYS_BEFORE_CLOSE }} days.'
+          stale-pr-message: 'This pull request has been marked ${{ env.STALE_LABEL_URL }} because it has been open for ${{ env.DAYS_BEFORE_STALE }} days with no activity. Please close this pull request if it is no longer needed. If this pull request is still relevant and you would like it to remain open, simply update it within the next ${{ env.DAYS_BEFORE_CLOSE }} days.'

dist/main.cjs

@@ -9201,7 +9201,7 @@ var require_readable = __commonJS({
     var kBody = Symbol("kBody");
     var kAbort = Symbol("abort");
     var kContentType = Symbol("kContentType");
-    var noop = () => {
+    var noop2 = () => {
     };
     module2.exports = class BodyReadable extends Readable {
       constructor({
@@ -9323,7 +9323,7 @@ var require_readable = __commonJS({
         return new Promise((resolve, reject) => {
           const signalListenerCleanup = signal ? util.addAbortListener(signal, () => {
             this.destroy();
-          }) : noop;
+          }) : noop2;
           this.on("close", function() {
             signalListenerCleanup();
             if (signal && signal.aborted) {
@@ -9331,7 +9331,7 @@ var require_readable = __commonJS({
             } else {
               resolve(null);
             }
-          }).on("error", noop).on("data", function(chunk) {
+          }).on("error", noop2).on("data", function(chunk) {
             limit -= chunk.length;
             if (limit <= 0) {
               this.destroy();
@@ -20879,7 +20879,7 @@ var require_util8 = __commonJS({
         yield* this[kBody];
       }
     };
-    function noop() {
+    function noop2() {
     }
     function wrapRequestBody(body) {
       if (isStream(body)) {
@@ -21290,7 +21290,7 @@ var require_util8 = __commonJS({
     }
     var setupConnectTimeout = process.platform === "win32" ? (socketWeakRef, opts) => {
       if (!opts.timeout) {
-        return noop;
+        return noop2;
       }
       let s1 = null;
       let s2 = null;
@@ -21306,7 +21306,7 @@ var require_util8 = __commonJS({
       };
     } : (socketWeakRef, opts) => {
       if (!opts.timeout) {
-        return noop;
+        return noop2;
       }
       let s1 = null;
       const fastTimer = timers.setFastTimeout(() => {
@@ -25556,12 +25556,12 @@ var require_body2 = __commonJS({
       random = (max) => Math.floor(Math.random() * max);
     }
     var textEncoder = new TextEncoder();
-    function noop() {
+    function noop2() {
     }
     var streamRegistry = new FinalizationRegistry((weakRef) => {
       const stream = weakRef.deref();
       if (stream && !stream.locked && !isDisturbed(stream) && !isErrored(stream)) {
-        stream.cancel("Response object has been garbage collected").catch(noop);
+        stream.cancel("Response object has been garbage collected").catch(noop2);
       }
     });
     function extractBody(object, keepalive = false) {
@@ -27650,7 +27650,7 @@ var require_client2 = __commonJS({
     var getDefaultNodeMaxHeaderSize = http && http.maxHeaderSize && Number.isInteger(http.maxHeaderSize) && http.maxHeaderSize > 0 ? () => http.maxHeaderSize : () => {
       throw new InvalidArgumentError("http module not available or http.maxHeaderSize invalid");
     };
-    var noop = () => {
+    var noop2 = () => {
     };
     function getPipelining(client) {
       return client[kPipelining] ?? client[kHTTPContext]?.defaultPipelining ?? 1;
@@ -27924,7 +27924,7 @@ var require_client2 = __commonJS({
           return;
         }
         if (client.destroyed) {
-          util.destroy(socket.on("error", noop), new ClientDestroyedError());
+          util.destroy(socket.on("error", noop2), new ClientDestroyedError());
           client[kResume]();
           return;
         }
@@ -27932,7 +27932,7 @@ var require_client2 = __commonJS({
         try {
           client[kHTTPContext] = socket.alpnProtocol === "h2" ? connectH2(client, socket) : connectH1(client, socket);
         } catch (err2) {
-          socket.destroy().on("error", noop);
+          socket.destroy().on("error", noop2);
           handleConnectError(client, err2, { host, hostname, protocol, port });
           client[kResume]();
           return;
@@ -28716,7 +28716,7 @@ var require_proxy_agent2 = __commonJS({
     function defaultFactory(origin, opts) {
       return new Pool(origin, opts);
     }
-    var noop = () => {
+    var noop2 = () => {
     };
     function defaultAgentFactory(origin, opts) {
       if (opts.connections === 1) {
@@ -28833,7 +28833,7 @@ var require_proxy_agent2 = __commonJS({
                 servername: this[kProxyTls]?.servername || proxyHostname
               });
               if (statusCode !== 200) {
-                socket.on("error", noop).destroy();
+                socket.on("error", noop2).destroy();
                 callback(new RequestAbortedError(`Proxy response (${statusCode}) !== 200 when HTTP Tunneling`));
               }
               if (opts2.protocol !== "https:") {
@@ -29500,7 +29500,7 @@ var require_readable2 = __commonJS({
     var kContentLength = Symbol("kContentLength");
     var kUsed = Symbol("kUsed");
     var kBytesRead = Symbol("kBytesRead");
-    var noop = () => {
+    var noop2 = () => {
     };
     var BodyReadable = class extends Readable {
       /**
@@ -29725,7 +29725,7 @@ var require_readable2 = __commonJS({
           } else {
             this.on("close", resolve);
           }
-          this.on("error", noop).on("data", () => {
+          this.on("error", noop2).on("data", () => {
             if (this[kBytesRead] > limit) {
               this.destroy();
             }
@@ -29894,7 +29894,7 @@ var require_api_request2 = __commonJS({
     var { Readable } = require_readable2();
     var { InvalidArgumentError, RequestAbortedError } = require_errors2();
     var util = require_util8();
-    function noop() {
+    function noop2() {
     }
     var RequestHandler = class extends AsyncResource {
       constructor(opts, callback) {
@@ -29921,7 +29921,7 @@ var require_api_request2 = __commonJS({
           super("UNDICI_REQUEST");
         } catch (err) {
           if (util.isStream(body)) {
-            util.destroy(body.on("error", noop), err);
+            util.destroy(body.on("error", noop2), err);
           }
           throw err;
         }
@@ -29944,7 +29944,7 @@ var require_api_request2 = __commonJS({
           this.removeAbortListener = util.addAbortListener(signal, () => {
             this.reason = signal.reason ?? new RequestAbortedError();
             if (this.res) {
-              util.destroy(this.res.on("error", noop), this.reason);
+              util.destroy(this.res.on("error", noop2), this.reason);
             } else if (this.abort) {
               this.abort(this.reason);
             }
@@ -29997,7 +29997,7 @@ var require_api_request2 = __commonJS({
             });
           } catch (err) {
             this.res = null;
-            util.destroy(res.on("error", noop), err);
+            util.destroy(res.on("error", noop2), err);
             queueMicrotask(() => {
               throw err;
             });
@@ -30022,13 +30022,13 @@ var require_api_request2 = __commonJS({
         if (res) {
           this.res = null;
           queueMicrotask(() => {
-            util.destroy(res.on("error", noop), err);
+            util.destroy(res.on("error", noop2), err);
           });
         }
         if (body) {
           this.body = null;
           if (util.isStream(body)) {
-            body.on("error", noop);
+            body.on("error", noop2);
             util.destroy(body, err);
           }
         }
@@ -30124,7 +30124,7 @@ var require_api_stream2 = __commonJS({
     var { InvalidArgumentError, InvalidReturnValueError } = require_errors2();
     var util = require_util8();
     var { addSignal, removeSignal } = require_abort_signal2();
-    function noop() {
+    function noop2() {
     }
     var StreamHandler = class extends AsyncResource {
       constructor(opts, factory, callback) {
@@ -30151,7 +30151,7 @@ var require_api_stream2 = __commonJS({
           super("UNDICI_STREAM");
         } catch (err) {
           if (util.isStream(body)) {
-            util.destroy(body.on("error", noop), err);
+            util.destroy(body.on("error", noop2), err);
           }
           throw err;
         }
@@ -30293,7 +30293,7 @@ var require_api_pipeline2 = __commonJS({
     } = require_errors2();
     var util = require_util8();
     var { addSignal, removeSignal } = require_abort_signal2();
-    function noop() {
+    function noop2() {
     }
     var kResume = Symbol("resume");
     var PipelineRequest = class extends Readable {
@@ -30353,7 +30353,7 @@ var require_api_pipeline2 = __commonJS({
         this.abort = null;
         this.context = null;
         this.onInfo = onInfo || null;
-        this.req = new PipelineRequest().on("error", noop);
+        this.req = new PipelineRequest().on("error", noop2);
         this.ret = new Duplex({
           readableObjectMode: opts.objectMode,
           autoDestroy: true,
@@ -30424,7 +30424,7 @@ var require_api_pipeline2 = __commonJS({
             context
           });
         } catch (err) {
-          this.res.on("error", noop);
+          this.res.on("error", noop2);
           throw err;
         }
         if (!body || typeof body.on !== "function") {
@@ -32646,7 +32646,7 @@ var require_redirect_handler = __commonJS({
     var EE = require("node:events");
     var redirectableStatusCodes = [300, 301, 302, 303, 307, 308];
     var kBody = Symbol("body");
-    var noop = () => {
+    var noop2 = () => {
     };
     var BodyAsyncIterable = class {
       constructor(body) {
@@ -32709,14 +32709,14 @@ var require_redirect_handler = __commonJS({
         if ((statusCode === 301 || statusCode === 302) && this.opts.method === "POST") {
           this.opts.method = "GET";
           if (util.isStream(this.opts.body)) {
-            util.destroy(this.opts.body.on("error", noop));
+            util.destroy(this.opts.body.on("error", noop2));
           }
           this.opts.body = null;
         }
         if (statusCode === 303 && this.opts.method !== "HEAD") {
           this.opts.method = "GET";
           if (util.isStream(this.opts.body)) {
-            util.destroy(this.opts.body.on("error", noop));
+            util.destroy(this.opts.body.on("error", noop2));
           }
           this.opts.body = null;
         }
@@ -34104,7 +34104,7 @@ var require_cache_handler = __commonJS({
       isEtagUsable
     } = require_cache2();
     var { parseHttpDate } = require_date();
-    function noop() {
+    function noop2() {
     }
     var HEURISTICALLY_CACHEABLE_STATUS_CODES = [
       200,
@@ -34185,7 +34185,7 @@ var require_cache_handler = __commonJS({
         );
         if (!util.safeHTTPMethods.includes(this.#cacheKey.method) && statusCode >= 200 && statusCode <= 399) {
           try {
-            this.#store.delete(this.#cacheKey)?.catch?.(noop);
+            this.#store.delete(this.#cacheKey)?.catch?.(noop2);
           } catch {
           }
           return downstreamOnHeaders();
@@ -42681,7 +42681,7 @@ var RequestError = class extends Error {
    */
   response;
   constructor(message, statusCode, options) {
-    super(message);
+    super(message, { cause: options.cause });
     this.name = "HttpError";
     this.status = Number.parseInt(statusCode);
     if (Number.isNaN(this.status)) {
@@ -42705,7 +42705,7 @@ var RequestError = class extends Error {
 };
 
 // node_modules/@octokit/request/dist-bundle/index.js
-var VERSION2 = "10.0.5";
+var VERSION2 = "10.0.7";
 var defaults_default = {
   headers: {
     "user-agent": `octokit-request.js/${VERSION2} ${getUserAgent()}`
@@ -42719,6 +42719,7 @@ function isPlainObject2(value) {
   const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor;
   return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value);
 }
+var noop = () => "";
 async function fetchWrapper(requestOptions) {
   const fetch = requestOptions.request?.fetch || globalThis.fetch;
   if (!fetch) {
@@ -42820,7 +42821,7 @@ async function fetchWrapper(requestOptions) {
 async function getResponseData(response) {
   const contentType = response.headers.get("content-type");
   if (!contentType) {
-    return response.text().catch(() => "");
+    return response.text().catch(noop);
   }
   const mimetype = (0, import_fast_content_type_parse.safeParse)(contentType);
   if (isJSONResponse(mimetype)) {
@@ -42832,9 +42833,12 @@ async function getResponseData(response) {
       return text;
     }
   } else if (mimetype.type.startsWith("text/") || mimetype.parameters.charset?.toLowerCase() === "utf-8") {
-    return response.text().catch(() => "");
+    return response.text().catch(noop);
   } else {
-    return response.arrayBuffer().catch(() => new ArrayBuffer(0));
+    return response.arrayBuffer().catch(
+      /* v8 ignore next -- @preserve */
+      () => new ArrayBuffer(0)
+    );
   }
 }
 function isJSONResponse(mimetype) {
@@ -43488,11 +43492,11 @@ function createOAuthAppAuth(options) {
 }
 
 // node_modules/universal-github-app-jwt/lib/utils.js
-function isPkcs1(privateKey2) {
+function isPkcs1(privateKey) {
-  return privateKey2.includes("-----BEGIN RSA PRIVATE KEY-----");
+  return privateKey.includes("-----BEGIN RSA PRIVATE KEY-----");
 }
-function isOpenSsh(privateKey2) {
+function isOpenSsh(privateKey) {
-  return privateKey2.includes("-----BEGIN OPENSSH PRIVATE KEY-----");
+  return privateKey.includes("-----BEGIN OPENSSH PRIVATE KEY-----");
 }
 function string2ArrayBuffer(str) {
   const buf = new ArrayBuffer(str.length);
@@ -43533,17 +43537,17 @@ __export(crypto_node_exports, {
 });
 __reExport(crypto_node_exports, require("node:crypto"));
 var import_node_crypto = require("node:crypto");
-function convertPrivateKey(privateKey2) {
+function convertPrivateKey(privateKey) {
-  if (!isPkcs1(privateKey2)) return privateKey2;
+  if (!isPkcs1(privateKey)) return privateKey;
-  return (0, import_node_crypto.createPrivateKey)(privateKey2).export({
+  return (0, import_node_crypto.createPrivateKey)(privateKey).export({
     type: "pkcs8",
     format: "pem"
   });
 }
 
 // node_modules/universal-github-app-jwt/lib/get-token.js
-async function getToken({ privateKey: privateKey2, payload }) {
+async function getToken({ privateKey, payload }) {
-  const convertedPrivateKey = convertPrivateKey(privateKey2);
+  const convertedPrivateKey = convertPrivateKey(privateKey);
   if (isPkcs1(convertedPrivateKey)) {
     throw new Error(
       "[universal-github-app-jwt] Private Key is in PKCS#1 format, but only PKCS#8 is supported. See https://github.com/gr2m/universal-github-app-jwt#private-key-formats"
@@ -43581,10 +43585,10 @@ async function getToken({ privateKey: privateKey2, payload }) {
 // node_modules/universal-github-app-jwt/index.js
 async function githubAppJwt({
   id,
-  privateKey: privateKey2,
+  privateKey,
   now = Math.floor(Date.now() / 1e3)
 }) {
-  const privateKeyWithNewlines = privateKey2.replace(/\\n/g, "\n");
+  const privateKeyWithNewlines = privateKey.replace(/\\n/g, "\n");
   const nowWithSafetyMargin = now - 30;
   const expiration = nowWithSafetyMargin + 60 * 10;
   const payload = {
@@ -43742,24 +43746,24 @@ var LruObject = class {
 
 // node_modules/@octokit/auth-app/dist-node/index.js
 async function getAppAuthentication({
-  appId: appId2,
+  appId,
-  privateKey: privateKey2,
+  privateKey,
   timeDifference,
   createJwt
 }) {
   try {
     if (createJwt) {
-      const { jwt, expiresAt } = await createJwt(appId2, timeDifference);
+      const { jwt, expiresAt } = await createJwt(appId, timeDifference);
       return {
         type: "app",
         token: jwt,
-        appId: appId2,
+        appId,
         expiresAt
       };
     }
     const authOptions = {
-      id: appId2,
+      id: appId,
-      privateKey: privateKey2
+      privateKey
     };
     if (timeDifference) {
       Object.assign(authOptions, {
@@ -43774,7 +43778,7 @@ async function getAppAuthentication({
       expiresAt: new Date(appAuthentication.expiration * 1e3).toISOString()
     };
   } catch (error) {
-    if (privateKey2 === "-----BEGIN RSA PRIVATE KEY-----") {
+    if (privateKey === "-----BEGIN RSA PRIVATE KEY-----") {
       throw new Error(
         "The 'privateKey` option contains only the first line '-----BEGIN RSA PRIVATE KEY-----'. If you are setting it using a `.env` file, make sure it is set on a single line with newlines replaced by '\n'"
       );
@@ -43805,19 +43809,19 @@ async function get(cache, options) {
     permissionsString,
     singleFileName
   ] = result.split("|");
-  const permissions2 = options.permissions || permissionsString.split(/,/).reduce((permissions22, string) => {
+  const permissions = options.permissions || permissionsString.split(/,/).reduce((permissions2, string) => {
     if (/!$/.test(string)) {
-      permissions22[string.slice(0, -1)] = "write";
+      permissions2[string.slice(0, -1)] = "write";
     } else {
-      permissions22[string] = "read";
+      permissions2[string] = "read";
     }
-    return permissions22;
+    return permissions2;
   }, {});
   return {
     token,
     createdAt,
     expiresAt,
-    permissions: permissions2,
+    permissions,
     repositoryIds: options.repositoryIds,
     repositoryNames: options.repositoryNames,
     singleFileName,
@@ -43841,11 +43845,11 @@ async function set(cache, options, data) {
 }
 function optionsToCacheKey({
   installationId,
-  permissions: permissions2 = {},
+  permissions = {},
   repositoryIds = [],
   repositoryNames = []
 }) {
-  const permissionsString = Object.keys(permissions2).sort().map((name) => permissions2[name] === "read" ? name : `${name}!`).join(",");
+  const permissionsString = Object.keys(permissions).sort().map((name) => permissions[name] === "read" ? name : `${name}!`).join(",");
   const repositoryIdsString = repositoryIds.sort().join(",");
   const repositoryNamesString = repositoryNames.join(",");
   return [
@@ -43861,7 +43865,7 @@ function toTokenAuthentication({
   createdAt,
   expiresAt,
   repositorySelection,
-  permissions: permissions2,
+  permissions,
   repositoryIds,
   repositoryNames,
   singleFileName
@@ -43872,7 +43876,7 @@ function toTokenAuthentication({
       tokenType: "installation",
       token,
       installationId,
-      permissions: permissions2,
+      permissions,
       createdAt,
       expiresAt,
       repositorySelection
@@ -43925,7 +43929,7 @@ async function getInstallationAuthenticationImpl(state, options, request2) {
         token: token2,
         createdAt: createdAt2,
         expiresAt: expiresAt2,
-        permissions: permissions22,
+        permissions: permissions2,
         repositoryIds: repositoryIds2,
         repositoryNames: repositoryNames2,
         singleFileName: singleFileName2,
@@ -43936,7 +43940,7 @@ async function getInstallationAuthenticationImpl(state, options, request2) {
         token: token2,
         createdAt: createdAt2,
         expiresAt: expiresAt2,
-        permissions: permissions22,
+        permissions: permissions2,
         repositorySelection: repositorySelection2,
         repositoryIds: repositoryIds2,
         repositoryNames: repositoryNames2,
@@ -43969,7 +43973,7 @@ async function getInstallationAuthenticationImpl(state, options, request2) {
     data: {
       token,
       expires_at: expiresAt,
-      repositories: repositories2,
+      repositories,
       permissions: permissionsOptional,
       repository_selection: repositorySelectionOptional,
       single_file: singleFileName
@@ -43978,17 +43982,17 @@ async function getInstallationAuthenticationImpl(state, options, request2) {
     "POST /app/installations/{installation_id}/access_tokens",
     payload
   );
-  const permissions2 = permissionsOptional || {};
+  const permissions = permissionsOptional || {};
   const repositorySelection = repositorySelectionOptional || "all";
-  const repositoryIds = repositories2 ? repositories2.map((r) => r.id) : void 0;
+  const repositoryIds = repositories ? repositories.map((r) => r.id) : void 0;
-  const repositoryNames = repositories2 ? repositories2.map((repo) => repo.name) : void 0;
+  const repositoryNames = repositories ? repositories.map((repo) => repo.name) : void 0;
   const createdAt = (/* @__PURE__ */ new Date()).toISOString();
   const cacheOptions = {
     token,
     createdAt,
     expiresAt,
     repositorySelection,
-    permissions: permissions2,
+    permissions,
     repositoryIds,
     repositoryNames
   };
@@ -44002,7 +44006,7 @@ async function getInstallationAuthenticationImpl(state, options, request2) {
     createdAt,
     expiresAt,
     repositorySelection,
-    permissions: permissions2,
+    permissions,
     repositoryIds,
     repositoryNames
   };
@@ -44148,7 +44152,7 @@ async function sendRequestWithRetries(state, request2, options, createdAt, retri
     return sendRequestWithRetries(state, request2, options, createdAt, retries);
   }
 }
-var VERSION6 = "8.1.1";
+var VERSION6 = "8.1.2";
 function createAppAuth(options) {
   if (!options.appId) {
     throw new Error("[@octokit/auth-app] appId option is required");
@@ -44198,16 +44202,16 @@ function createAppAuth(options) {
 
 // lib/get-permissions-from-inputs.js
 function getPermissionsFromInputs(env) {
-  return Object.entries(env).reduce((permissions2, [key, value]) => {
+  return Object.entries(env).reduce((permissions, [key, value]) => {
-    if (!key.startsWith("INPUT_PERMISSION-")) return permissions2;
+    if (!key.startsWith("INPUT_PERMISSION-")) return permissions;
-    if (!value) return permissions2;
+    if (!value) return permissions;
     const permission = key.slice("INPUT_PERMISSION-".length).toLowerCase().replaceAll(/-/g, "_");
-    if (permissions2 === void 0) {
+    if (permissions === void 0) {
       return { [permission]: value };
     }
     return {
       // @ts-expect-error - needs to be typed correctly
-      ...permissions2,
+      ...permissions,
       [permission]: value
     };
   }, void 0);
@@ -44407,43 +44411,43 @@ async function pRetry(input, options = {}) {
 }
 
 // lib/main.js
-async function main(appId2, privateKey2, owner2, repositories2, permissions2, core3, createAppAuth2, request2, skipTokenRevoke2) {
+async function main(appId, privateKey, owner, repositories, permissions, core3, createAppAuth2, request2, skipTokenRevoke) {
   let parsedOwner = "";
   let parsedRepositoryNames = [];
-  if (!owner2 && repositories2.length === 0) {
+  if (!owner && repositories.length === 0) {
-    const [owner3, repo] = String(process.env.GITHUB_REPOSITORY).split("/");
+    const [owner2, repo] = String(process.env.GITHUB_REPOSITORY).split("/");
-    parsedOwner = owner3;
+    parsedOwner = owner2;
     parsedRepositoryNames = [repo];
     core3.info(
-      `Inputs 'owner' and 'repositories' are not set. Creating token for this repository (${owner3}/${repo}).`
+      `Inputs 'owner' and 'repositories' are not set. Creating token for this repository (${owner2}/${repo}).`
     );
   }
-  if (owner2 && repositories2.length === 0) {
+  if (owner && repositories.length === 0) {
-    parsedOwner = owner2;
+    parsedOwner = owner;
     core3.info(
-      `Input 'repositories' is not set. Creating token for all repositories owned by ${owner2}.`
+      `Input 'repositories' is not set. Creating token for all repositories owned by ${owner}.`
     );
   }
-  if (!owner2 && repositories2.length > 0) {
+  if (!owner && repositories.length > 0) {
     parsedOwner = String(process.env.GITHUB_REPOSITORY_OWNER);
-    parsedRepositoryNames = repositories2;
+    parsedRepositoryNames = repositories;
     core3.info(
-      `No 'owner' input provided. Using default owner '${parsedOwner}' to create token for the following repositories:${repositories2.map((repo) => `
+      `No 'owner' input provided. Using default owner '${parsedOwner}' to create token for the following repositories:${repositories.map((repo) => `
 - ${parsedOwner}/${repo}`).join("")}`
     );
   }
-  if (owner2 && repositories2.length > 0) {
+  if (owner && repositories.length > 0) {
-    parsedOwner = owner2;
+    parsedOwner = owner;
-    parsedRepositoryNames = repositories2;
+    parsedRepositoryNames = repositories;
     core3.info(
       `Inputs 'owner' and 'repositories' are set. Creating token for the following repositories:
-      ${repositories2.map((repo) => `
+      ${repositories.map((repo) => `
 - ${parsedOwner}/${repo}`).join("")}`
     );
   }
   const auth5 = createAppAuth2({
-    appId: appId2,
+    appId,
-    privateKey: privateKey2,
+    privateKey,
     request: request2
   });
   let authentication, installationId, appSlug;
@@ -44454,7 +44458,7 @@ async function main(appId2, privateKey2, owner2, repositories2, permissions2, co
         auth5,
         parsedOwner,
         parsedRepositoryNames,
-        permissions2
+        permissions
       ),
       {
         shouldRetry: ({ error }) => error.status >= 500,
@@ -44470,7 +44474,7 @@ async function main(appId2, privateKey2, owner2, repositories2, permissions2, co
     ));
   } else {
     ({ authentication, installationId, appSlug } = await pRetry(
-      () => getTokenFromOwner(request2, auth5, parsedOwner, permissions2),
+      () => getTokenFromOwner(request2, auth5, parsedOwner, permissions),
       {
         onFailedAttempt: (context) => {
           core3.info(
@@ -44485,12 +44489,12 @@ async function main(appId2, privateKey2, owner2, repositories2, permissions2, co
   core3.setOutput("token", authentication.token);
   core3.setOutput("installation-id", installationId);
   core3.setOutput("app-slug", appSlug);
-  if (!skipTokenRevoke2) {
+  if (!skipTokenRevoke) {
     core3.saveState("token", authentication.token);
     core3.saveState("expiresAt", authentication.expiresAt);
   }
 }
-async function getTokenFromOwner(request2, auth5, parsedOwner, permissions2) {
+async function getTokenFromOwner(request2, auth5, parsedOwner, permissions) {
   const response = await request2("GET /users/{username}/installation", {
     username: parsedOwner,
     request: {
@@ -44500,13 +44504,13 @@ async function getTokenFromOwner(request2, auth5, parsedOwner, permissions2) {
   const authentication = await auth5({
     type: "installation",
     installationId: response.data.id,
-    permissions: permissions2
+    permissions
   });
   const installationId = response.data.id;
   const appSlug = response.data["app_slug"];
   return { authentication, installationId, appSlug };
 }
-async function getTokenFromRepository(request2, auth5, parsedOwner, parsedRepositoryNames, permissions2) {
+async function getTokenFromRepository(request2, auth5, parsedOwner, parsedRepositoryNames, permissions) {
   const response = await request2("GET /repos/{owner}/{repo}/installation", {
     owner: parsedOwner,
     repo: parsedRepositoryNames[0],
@@ -44518,7 +44522,7 @@ async function getTokenFromRepository(request2, auth5, parsedOwner, parsedReposi
     type: "installation",
     installationId: response.data.id,
     repositoryNames: parsedRepositoryNames,
-    permissions: permissions2
+    permissions
   });
   const installationId = response.data.id;
   const appSlug = response.data["app_slug"];
@@ -44552,6 +44556,36 @@ var request_default = request.defaults({
   request: proxyUrl ? { fetch: proxyFetch } : {}
 });
 
+// lib/run-with-proxy.js
+var import_node_child_process = require("node:child_process");
+async function runWithProxy(run) {
+  const httpProxyEnvVars = [
+    "https_proxy",
+    "HTTPS_PROXY",
+    "http_proxy",
+    "HTTP_PROXY"
+  ];
+  const nodeHasProxySupportEnabled = process.env.NODE_USE_ENV_PROXY === "1";
+  const shouldUseProxy = httpProxyEnvVars.some((v) => process.env[v]);
+  if (!nodeHasProxySupportEnabled && shouldUseProxy) {
+    return new Promise((resolve, reject) => {
+      const child = (0, import_node_child_process.spawn)(process.execPath, process.argv.slice(1), {
+        env: { ...process.env, NODE_USE_ENV_PROXY: "1" },
+        stdio: "inherit"
+      });
+      child.on("exit", (code) => {
+        process.exitCode = code;
+        if (code !== 0) {
+          reject(new Error(`Child process exited with code ${code}`));
+        } else {
+          resolve();
+        }
+      });
+    });
+  }
+  return run();
+}
+
 // main.js
 if (!process.env.GITHUB_REPOSITORY) {
   throw new Error("GITHUB_REPOSITORY missing, must be set to '<owner>/<repo>'");
@@ -44559,13 +44593,14 @@ if (!process.env.GITHUB_REPOSITORY) {
 if (!process.env.GITHUB_REPOSITORY_OWNER) {
   throw new Error("GITHUB_REPOSITORY_OWNER missing, must be set to '<owner>'");
 }
-var appId = import_core2.default.getInput("app-id");
+var main_default = runWithProxy(async () => {
-var privateKey = import_core2.default.getInput("private-key");
+  const appId = import_core2.default.getInput("app-id");
-var owner = import_core2.default.getInput("owner");
+  const privateKey = import_core2.default.getInput("private-key");
-var repositories = import_core2.default.getInput("repositories").split(/[\n,]+/).map((s) => s.trim()).filter((x) => x !== "");
+  const owner = import_core2.default.getInput("owner");
-var skipTokenRevoke = import_core2.default.getBooleanInput("skip-token-revoke");
+  const repositories = import_core2.default.getInput("repositories").split(/[\n,]+/).map((s) => s.trim()).filter((x) => x !== "");
-var permissions = getPermissionsFromInputs(process.env);
+  const skipTokenRevoke = import_core2.default.getBooleanInput("skip-token-revoke");
-var main_default = main(
+  const permissions = getPermissionsFromInputs(process.env);
+  return main(
     appId,
     privateKey,
     owner,
@@ -44575,9 +44610,10 @@ var main_default = main(
     createAppAuth,
     request_default,
     skipTokenRevoke
-).catch((error) => {
+  ).catch((error) => {
     console.error(error);
     import_core2.default.setFailed(error.message);
+  });
 });
 /*! Bundled license information:
 
@@ -44589,6 +44625,13 @@ undici/lib/websocket/frame.js:
 undici/lib/web/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 
+@octokit/request-error/dist-src/index.js:
+  (* v8 ignore else -- @preserve -- Bug with vitest coverage where it sees an else branch that doesn't exist *)
+
+@octokit/request/dist-bundle/index.js:
+  (* v8 ignore next -- @preserve *)
+  (* v8 ignore else -- @preserve *)
+
 toad-cache/dist/toad-cache.mjs:
   (**
    * toad-cache

dist/post.cjs

@@ -7,6 +7,10 @@ var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __commonJS = (cb, mod) => function __require() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
@@ -23,6 +27,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
   mod
 ));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // node_modules/@actions/core/lib/utils.js
 var require_utils = __commonJS({
@@ -9195,7 +9200,7 @@ var require_readable = __commonJS({
     var kBody = Symbol("kBody");
     var kAbort = Symbol("abort");
     var kContentType = Symbol("kContentType");
-    var noop = () => {
+    var noop2 = () => {
     };
     module2.exports = class BodyReadable extends Readable {
       constructor({
@@ -9317,7 +9322,7 @@ var require_readable = __commonJS({
         return new Promise((resolve, reject) => {
           const signalListenerCleanup = signal ? util.addAbortListener(signal, () => {
             this.destroy();
-          }) : noop;
+          }) : noop2;
           this.on("close", function() {
             signalListenerCleanup();
             if (signal && signal.aborted) {
@@ -9325,7 +9330,7 @@ var require_readable = __commonJS({
             } else {
               resolve(null);
             }
-          }).on("error", noop).on("data", function(chunk) {
+          }).on("error", noop2).on("data", function(chunk) {
             limit -= chunk.length;
             if (limit <= 0) {
               this.destroy();
@@ -20873,7 +20878,7 @@ var require_util8 = __commonJS({
         yield* this[kBody];
       }
     };
-    function noop() {
+    function noop2() {
     }
     function wrapRequestBody(body) {
       if (isStream(body)) {
@@ -21284,7 +21289,7 @@ var require_util8 = __commonJS({
     }
     var setupConnectTimeout = process.platform === "win32" ? (socketWeakRef, opts) => {
       if (!opts.timeout) {
-        return noop;
+        return noop2;
       }
       let s1 = null;
       let s2 = null;
@@ -21300,7 +21305,7 @@ var require_util8 = __commonJS({
       };
     } : (socketWeakRef, opts) => {
       if (!opts.timeout) {
-        return noop;
+        return noop2;
       }
       let s1 = null;
       const fastTimer = timers.setFastTimeout(() => {
@@ -25550,12 +25555,12 @@ var require_body2 = __commonJS({
       random = (max) => Math.floor(Math.random() * max);
     }
     var textEncoder = new TextEncoder();
-    function noop() {
+    function noop2() {
     }
     var streamRegistry = new FinalizationRegistry((weakRef) => {
       const stream = weakRef.deref();
       if (stream && !stream.locked && !isDisturbed(stream) && !isErrored(stream)) {
-        stream.cancel("Response object has been garbage collected").catch(noop);
+        stream.cancel("Response object has been garbage collected").catch(noop2);
       }
     });
     function extractBody(object, keepalive = false) {
@@ -27644,7 +27649,7 @@ var require_client2 = __commonJS({
     var getDefaultNodeMaxHeaderSize = http && http.maxHeaderSize && Number.isInteger(http.maxHeaderSize) && http.maxHeaderSize > 0 ? () => http.maxHeaderSize : () => {
       throw new InvalidArgumentError("http module not available or http.maxHeaderSize invalid");
     };
-    var noop = () => {
+    var noop2 = () => {
     };
     function getPipelining(client) {
       return client[kPipelining] ?? client[kHTTPContext]?.defaultPipelining ?? 1;
@@ -27918,7 +27923,7 @@ var require_client2 = __commonJS({
           return;
         }
         if (client.destroyed) {
-          util.destroy(socket.on("error", noop), new ClientDestroyedError());
+          util.destroy(socket.on("error", noop2), new ClientDestroyedError());
           client[kResume]();
           return;
         }
@@ -27926,7 +27931,7 @@ var require_client2 = __commonJS({
         try {
           client[kHTTPContext] = socket.alpnProtocol === "h2" ? connectH2(client, socket) : connectH1(client, socket);
         } catch (err2) {
-          socket.destroy().on("error", noop);
+          socket.destroy().on("error", noop2);
           handleConnectError(client, err2, { host, hostname, protocol, port });
           client[kResume]();
           return;
@@ -28710,7 +28715,7 @@ var require_proxy_agent2 = __commonJS({
     function defaultFactory(origin, opts) {
       return new Pool(origin, opts);
     }
-    var noop = () => {
+    var noop2 = () => {
     };
     function defaultAgentFactory(origin, opts) {
       if (opts.connections === 1) {
@@ -28827,7 +28832,7 @@ var require_proxy_agent2 = __commonJS({
                 servername: this[kProxyTls]?.servername || proxyHostname
               });
               if (statusCode !== 200) {
-                socket.on("error", noop).destroy();
+                socket.on("error", noop2).destroy();
                 callback(new RequestAbortedError(`Proxy response (${statusCode}) !== 200 when HTTP Tunneling`));
               }
               if (opts2.protocol !== "https:") {
@@ -29494,7 +29499,7 @@ var require_readable2 = __commonJS({
     var kContentLength = Symbol("kContentLength");
     var kUsed = Symbol("kUsed");
     var kBytesRead = Symbol("kBytesRead");
-    var noop = () => {
+    var noop2 = () => {
     };
     var BodyReadable = class extends Readable {
       /**
@@ -29719,7 +29724,7 @@ var require_readable2 = __commonJS({
           } else {
             this.on("close", resolve);
           }
-          this.on("error", noop).on("data", () => {
+          this.on("error", noop2).on("data", () => {
             if (this[kBytesRead] > limit) {
               this.destroy();
             }
@@ -29888,7 +29893,7 @@ var require_api_request2 = __commonJS({
     var { Readable } = require_readable2();
     var { InvalidArgumentError, RequestAbortedError } = require_errors2();
     var util = require_util8();
-    function noop() {
+    function noop2() {
     }
     var RequestHandler = class extends AsyncResource {
       constructor(opts, callback) {
@@ -29915,7 +29920,7 @@ var require_api_request2 = __commonJS({
           super("UNDICI_REQUEST");
         } catch (err) {
           if (util.isStream(body)) {
-            util.destroy(body.on("error", noop), err);
+            util.destroy(body.on("error", noop2), err);
           }
           throw err;
         }
@@ -29938,7 +29943,7 @@ var require_api_request2 = __commonJS({
           this.removeAbortListener = util.addAbortListener(signal, () => {
             this.reason = signal.reason ?? new RequestAbortedError();
             if (this.res) {
-              util.destroy(this.res.on("error", noop), this.reason);
+              util.destroy(this.res.on("error", noop2), this.reason);
             } else if (this.abort) {
               this.abort(this.reason);
             }
@@ -29991,7 +29996,7 @@ var require_api_request2 = __commonJS({
             });
           } catch (err) {
             this.res = null;
-            util.destroy(res.on("error", noop), err);
+            util.destroy(res.on("error", noop2), err);
             queueMicrotask(() => {
               throw err;
             });
@@ -30016,13 +30021,13 @@ var require_api_request2 = __commonJS({
         if (res) {
           this.res = null;
           queueMicrotask(() => {
-            util.destroy(res.on("error", noop), err);
+            util.destroy(res.on("error", noop2), err);
           });
         }
         if (body) {
           this.body = null;
           if (util.isStream(body)) {
-            body.on("error", noop);
+            body.on("error", noop2);
             util.destroy(body, err);
           }
         }
@@ -30118,7 +30123,7 @@ var require_api_stream2 = __commonJS({
     var { InvalidArgumentError, InvalidReturnValueError } = require_errors2();
     var util = require_util8();
     var { addSignal, removeSignal } = require_abort_signal2();
-    function noop() {
+    function noop2() {
     }
     var StreamHandler = class extends AsyncResource {
       constructor(opts, factory, callback) {
@@ -30145,7 +30150,7 @@ var require_api_stream2 = __commonJS({
           super("UNDICI_STREAM");
         } catch (err) {
           if (util.isStream(body)) {
-            util.destroy(body.on("error", noop), err);
+            util.destroy(body.on("error", noop2), err);
           }
           throw err;
         }
@@ -30287,7 +30292,7 @@ var require_api_pipeline2 = __commonJS({
     } = require_errors2();
     var util = require_util8();
     var { addSignal, removeSignal } = require_abort_signal2();
-    function noop() {
+    function noop2() {
     }
     var kResume = Symbol("resume");
     var PipelineRequest = class extends Readable {
@@ -30347,7 +30352,7 @@ var require_api_pipeline2 = __commonJS({
         this.abort = null;
         this.context = null;
         this.onInfo = onInfo || null;
-        this.req = new PipelineRequest().on("error", noop);
+        this.req = new PipelineRequest().on("error", noop2);
         this.ret = new Duplex({
           readableObjectMode: opts.objectMode,
           autoDestroy: true,
@@ -30418,7 +30423,7 @@ var require_api_pipeline2 = __commonJS({
             context
           });
         } catch (err) {
-          this.res.on("error", noop);
+          this.res.on("error", noop2);
           throw err;
         }
         if (!body || typeof body.on !== "function") {
@@ -32640,7 +32645,7 @@ var require_redirect_handler = __commonJS({
     var EE = require("node:events");
     var redirectableStatusCodes = [300, 301, 302, 303, 307, 308];
     var kBody = Symbol("body");
-    var noop = () => {
+    var noop2 = () => {
     };
     var BodyAsyncIterable = class {
       constructor(body) {
@@ -32703,14 +32708,14 @@ var require_redirect_handler = __commonJS({
         if ((statusCode === 301 || statusCode === 302) && this.opts.method === "POST") {
           this.opts.method = "GET";
           if (util.isStream(this.opts.body)) {
-            util.destroy(this.opts.body.on("error", noop));
+            util.destroy(this.opts.body.on("error", noop2));
           }
           this.opts.body = null;
         }
         if (statusCode === 303 && this.opts.method !== "HEAD") {
           this.opts.method = "GET";
           if (util.isStream(this.opts.body)) {
-            util.destroy(this.opts.body.on("error", noop));
+            util.destroy(this.opts.body.on("error", noop2));
           }
           this.opts.body = null;
         }
@@ -34098,7 +34103,7 @@ var require_cache_handler = __commonJS({
       isEtagUsable
     } = require_cache2();
     var { parseHttpDate } = require_date();
-    function noop() {
+    function noop2() {
     }
     var HEURISTICALLY_CACHEABLE_STATUS_CODES = [
       200,
@@ -34179,7 +34184,7 @@ var require_cache_handler = __commonJS({
         );
         if (!util.safeHTTPMethods.includes(this.#cacheKey.method) && statusCode >= 200 && statusCode <= 399) {
           try {
-            this.#store.delete(this.#cacheKey)?.catch?.(noop);
+            this.#store.delete(this.#cacheKey)?.catch?.(noop2);
           } catch {
           }
           return downstreamOnHeaders();
@@ -42325,6 +42330,11 @@ var require_undici2 = __commonJS({
 });
 
 // post.js
+var post_exports = {};
+__export(post_exports, {
+  default: () => post_default
+});
+module.exports = __toCommonJS(post_exports);
 var import_core2 = __toESM(require_core(), 1);
 
 // lib/post.js
@@ -42707,7 +42717,7 @@ var RequestError = class extends Error {
    */
   response;
   constructor(message, statusCode, options) {
-    super(message);
+    super(message, { cause: options.cause });
     this.name = "HttpError";
     this.status = Number.parseInt(statusCode);
     if (Number.isNaN(this.status)) {
@@ -42731,7 +42741,7 @@ var RequestError = class extends Error {
 };
 
 // node_modules/@octokit/request/dist-bundle/index.js
-var VERSION2 = "10.0.5";
+var VERSION2 = "10.0.7";
 var defaults_default = {
   headers: {
     "user-agent": `octokit-request.js/${VERSION2} ${getUserAgent()}`
@@ -42745,6 +42755,7 @@ function isPlainObject2(value) {
   const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor;
   return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value);
 }
+var noop = () => "";
 async function fetchWrapper(requestOptions) {
   const fetch = requestOptions.request?.fetch || globalThis.fetch;
   if (!fetch) {
@@ -42846,7 +42857,7 @@ async function fetchWrapper(requestOptions) {
 async function getResponseData(response) {
   const contentType = response.headers.get("content-type");
   if (!contentType) {
-    return response.text().catch(() => "");
+    return response.text().catch(noop);
   }
   const mimetype = (0, import_fast_content_type_parse.safeParse)(contentType);
   if (isJSONResponse(mimetype)) {
@@ -42858,9 +42869,12 @@ async function getResponseData(response) {
       return text;
     }
   } else if (mimetype.type.startsWith("text/") || mimetype.parameters.charset?.toLowerCase() === "utf-8") {
-    return response.text().catch(() => "");
+    return response.text().catch(noop);
   } else {
-    return response.arrayBuffer().catch(() => new ArrayBuffer(0));
+    return response.arrayBuffer().catch(
+      /* v8 ignore next -- @preserve */
+      () => new ArrayBuffer(0)
+    );
   }
 }
 function isJSONResponse(mimetype) {
@@ -42930,10 +42944,42 @@ var request_default = request.defaults({
   request: proxyUrl ? { fetch: proxyFetch } : {}
 });
 
+// lib/run-with-proxy.js
+var import_node_child_process = require("node:child_process");
+async function runWithProxy(run) {
+  const httpProxyEnvVars = [
+    "https_proxy",
+    "HTTPS_PROXY",
+    "http_proxy",
+    "HTTP_PROXY"
+  ];
+  const nodeHasProxySupportEnabled = process.env.NODE_USE_ENV_PROXY === "1";
+  const shouldUseProxy = httpProxyEnvVars.some((v) => process.env[v]);
+  if (!nodeHasProxySupportEnabled && shouldUseProxy) {
+    return new Promise((resolve, reject) => {
+      const child = (0, import_node_child_process.spawn)(process.execPath, process.argv.slice(1), {
+        env: { ...process.env, NODE_USE_ENV_PROXY: "1" },
+        stdio: "inherit"
+      });
+      child.on("exit", (code) => {
+        process.exitCode = code;
+        if (code !== 0) {
+          reject(new Error(`Child process exited with code ${code}`));
+        } else {
+          resolve();
+        }
+      });
+    });
+  }
+  return run();
+}
+
 // post.js
-post(import_core2.default, request_default).catch((error) => {
+var post_default = runWithProxy(async () => {
+  return post(import_core2.default, request_default).catch((error) => {
     console.error(error);
     import_core2.default.setFailed(error.message);
+  });
 });
 /*! Bundled license information:
 
@@ -42944,4 +42990,11 @@ undici/lib/web/fetch/body.js:
 undici/lib/websocket/frame.js:
 undici/lib/web/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
+
+@octokit/request-error/dist-src/index.js:
+  (* v8 ignore else -- @preserve -- Bug with vitest coverage where it sees an else branch that doesn't exist *)
+
+@octokit/request/dist-bundle/index.js:
+  (* v8 ignore next -- @preserve *)
+  (* v8 ignore else -- @preserve *)
 */

lib/run-with-proxy.js

@@ -0,0 +1,44 @@
+// @ts-check
+
+import { spawn } from "node:child_process";
+
+/**
+ * Wraps a function to automatically enable Node.js proxy support when proxy
+ * environment variables are detected. If proxy env vars are set but
+ * `NODE_USE_ENV_PROXY` is not `"1"`, spawns a child process with
+ * `NODE_USE_ENV_PROXY=1` to enable native proxy support.
+ *
+ * @param {() => Promise<void>} run
+ * @returns {Promise<void>}
+ *
+ * @see https://github.com/nodejs/node/blob/4612c793cb9007a91cb3fd82afe518440473826e/lib/internal/process/pre_execution.js#L168-L187
+ */
+export async function runWithProxy(run) {
+  const httpProxyEnvVars = [
+    "https_proxy",
+    "HTTPS_PROXY",
+    "http_proxy",
+    "HTTP_PROXY",
+  ];
+  const nodeHasProxySupportEnabled = process.env.NODE_USE_ENV_PROXY === "1";
+  const shouldUseProxy = httpProxyEnvVars.some((v) => process.env[v]);
+
+  if (!nodeHasProxySupportEnabled && shouldUseProxy) {
+    return new Promise((resolve, reject) => {
+      const child = spawn(process.execPath, process.argv.slice(1), {
+        env: { ...process.env, NODE_USE_ENV_PROXY: "1" },
+        stdio: "inherit",
+      });
+      child.on("exit", (code) => {
+        process.exitCode = code;
+        if (code !== 0) {
+          reject(new Error(`Child process exited with code ${code}`));
+        } else {
+          resolve();
+        }
+      });
+    });
+  }
+
+  return run();
+}

main.js

@@ -6,6 +6,7 @@ import { createAppAuth } from "@octokit/auth-app";
 import { getPermissionsFromInputs } from "./lib/get-permissions-from-inputs.js";
 import { main } from "./lib/main.js";
 import request from "./lib/request.js";
+import { runWithProxy } from "./lib/run-with-proxy.js";
 
 if (!process.env.GITHUB_REPOSITORY) {
   throw new Error("GITHUB_REPOSITORY missing, must be set to '<owner>/<repo>'");
@@ -15,21 +16,22 @@ if (!process.env.GITHUB_REPOSITORY_OWNER) {
   throw new Error("GITHUB_REPOSITORY_OWNER missing, must be set to '<owner>'");
 }
 
-const appId = core.getInput("app-id");
+// Export promise for testing
-const privateKey = core.getInput("private-key");
+export default runWithProxy(async () => {
-const owner = core.getInput("owner");
+  const appId = core.getInput("app-id");
-const repositories = core
+  const privateKey = core.getInput("private-key");
+  const owner = core.getInput("owner");
+  const repositories = core
     .getInput("repositories")
     .split(/[\n,]+/)
     .map((s) => s.trim())
     .filter((x) => x !== "");
 
-const skipTokenRevoke = core.getBooleanInput("skip-token-revoke");
+  const skipTokenRevoke = core.getBooleanInput("skip-token-revoke");
 
-const permissions = getPermissionsFromInputs(process.env);
+  const permissions = getPermissionsFromInputs(process.env);
 
-// Export promise for testing
+  return main(
-export default main(
     appId,
     privateKey,
     owner,
@@ -39,8 +41,9 @@ export default main(
     createAppAuth,
     request,
     skipTokenRevoke,
-).catch((error) => {
+  ).catch((error) => {
     /* c8 ignore next 3 */
     console.error(error);
     core.setFailed(error.message);
+  });
 });

package-lock.json

@@ -1,16 +1,16 @@
 {
   "name": "create-github-app-token",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "create-github-app-token",
-      "version": "2.2.0",
+      "version": "2.2.1",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.11.1",
-        "@octokit/auth-app": "^8.1.1",
+        "@octokit/auth-app": "^8.1.2",
         "@octokit/request": "^10.0.3",
         "p-retry": "^7.1.0",
         "undici": "^7.16.0"
@@ -697,16 +697,16 @@
       }
     },
     "node_modules/@octokit/auth-app": {
-      "version": "8.1.1",
+      "version": "8.1.2",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-app/-/auth-app-8.1.1.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-app/-/auth-app-8.1.2.tgz",
-      "integrity": "sha512-yW9YUy1cuqWlz8u7908ed498wJFt42VYsYWjvepjojM4BdZSp4t+5JehFds7LfvYi550O/GaUI94rgbhswvxfA==",
+      "integrity": "sha512-db8VO0PqXxfzI6GdjtgEFHY9tzqUql5xMFXYA12juq8TeTgPAuiiP3zid4h50lwlIP457p5+56PnJOgd2GGBuw==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/auth-oauth-app": "^9.0.2",
+        "@octokit/auth-oauth-app": "^9.0.3",
-        "@octokit/auth-oauth-user": "^6.0.1",
+        "@octokit/auth-oauth-user": "^6.0.2",
-        "@octokit/request": "^10.0.5",
+        "@octokit/request": "^10.0.6",
-        "@octokit/request-error": "^7.0.1",
+        "@octokit/request-error": "^7.0.2",
-        "@octokit/types": "^15.0.0",
+        "@octokit/types": "^16.0.0",
         "toad-cache": "^3.7.0",
         "universal-github-app-jwt": "^2.2.0",
         "universal-user-agent": "^7.0.0"
@@ -716,15 +716,15 @@
       }
     },
     "node_modules/@octokit/auth-oauth-app": {
-      "version": "9.0.2",
+      "version": "9.0.3",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-oauth-app/-/auth-oauth-app-9.0.2.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-oauth-app/-/auth-oauth-app-9.0.3.tgz",
-      "integrity": "sha512-vmjSHeuHuM+OxZLzOuoYkcY3OPZ8erJ5lfswdTmm+4XiAKB5PmCk70bA1is4uwSl/APhRVAv4KHsgevWfEKIPQ==",
+      "integrity": "sha512-+yoFQquaF8OxJSxTb7rnytBIC2ZLbLqA/yb71I4ZXT9+Slw4TziV9j/kyGhUFRRTF2+7WlnIWsePZCWHs+OGjg==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/auth-oauth-device": "^8.0.2",
+        "@octokit/auth-oauth-device": "^8.0.3",
-        "@octokit/auth-oauth-user": "^6.0.1",
+        "@octokit/auth-oauth-user": "^6.0.2",
-        "@octokit/request": "^10.0.5",
+        "@octokit/request": "^10.0.6",
-        "@octokit/types": "^15.0.0",
+        "@octokit/types": "^16.0.0",
         "universal-user-agent": "^7.0.0"
       },
       "engines": {
@@ -732,14 +732,14 @@
       }
     },
     "node_modules/@octokit/auth-oauth-device": {
-      "version": "8.0.2",
+      "version": "8.0.3",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-oauth-device/-/auth-oauth-device-8.0.2.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-oauth-device/-/auth-oauth-device-8.0.3.tgz",
-      "integrity": "sha512-KW7Ywrz7ei7JX+uClWD2DN1259fnkoKuVdhzfpQ3/GdETaCj4Tx0IjvuJrwhP/04OhcMu5yR6tjni0V6LBihdw==",
+      "integrity": "sha512-zh2W0mKKMh/VWZhSqlaCzY7qFyrgd9oTWmTmHaXnHNeQRCZr/CXy2jCgHo4e4dJVTiuxP5dLa0YM5p5QVhJHbw==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/oauth-methods": "^6.0.1",
+        "@octokit/oauth-methods": "^6.0.2",
-        "@octokit/request": "^10.0.5",
+        "@octokit/request": "^10.0.6",
-        "@octokit/types": "^15.0.0",
+        "@octokit/types": "^16.0.0",
         "universal-user-agent": "^7.0.0"
       },
       "engines": {
@@ -747,15 +747,15 @@
       }
     },
     "node_modules/@octokit/auth-oauth-user": {
-      "version": "6.0.1",
+      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-oauth-user/-/auth-oauth-user-6.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-oauth-user/-/auth-oauth-user-6.0.2.tgz",
-      "integrity": "sha512-vlKsL1KUUPvwXpv574zvmRd+/4JiDFXABIZNM39+S+5j2kODzGgjk7w5WtiQ1x24kRKNaE7v9DShNbw43UA3Hw==",
+      "integrity": "sha512-qLoPPc6E6GJoz3XeDG/pnDhJpTkODTGG4kY0/Py154i/I003O9NazkrwJwRuzgCalhzyIeWQ+6MDvkUmKXjg/A==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/auth-oauth-device": "^8.0.2",
+        "@octokit/auth-oauth-device": "^8.0.3",
-        "@octokit/oauth-methods": "^6.0.1",
+        "@octokit/oauth-methods": "^6.0.2",
-        "@octokit/request": "^10.0.5",
+        "@octokit/request": "^10.0.6",
-        "@octokit/types": "^15.0.0",
+        "@octokit/types": "^16.0.0",
         "universal-user-agent": "^7.0.0"
       },
       "engines": {
@@ -763,12 +763,12 @@
       }
     },
     "node_modules/@octokit/endpoint": {
-      "version": "11.0.1",
+      "version": "11.0.2",
-      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.2.tgz",
-      "integrity": "sha512-7P1dRAZxuWAOPI7kXfio88trNi/MegQ0IJD3vfgC3b+LZo1Qe6gRJc2v0mz2USWWJOKrB2h5spXCzGbw+fAdqA==",
+      "integrity": "sha512-4zCpzP1fWc7QlqunZ5bSEjxc6yLAlRTnDwKtgXfcI/FxxGoqedDG8V2+xJ60bV2kODqcGB+nATdtap/XYq2NZQ==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^15.0.0",
+        "@octokit/types": "^16.0.0",
         "universal-user-agent": "^7.0.2"
       },
       "engines": {
@@ -785,15 +785,15 @@
       }
     },
     "node_modules/@octokit/oauth-methods": {
-      "version": "6.0.1",
+      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/@octokit/oauth-methods/-/oauth-methods-6.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/oauth-methods/-/oauth-methods-6.0.2.tgz",
-      "integrity": "sha512-xi6Iut3izMCFzXBJtxxJehxJmAKjE8iwj6L5+raPRwlTNKAbOOBJX7/Z8AF5apD4aXvc2skwIdOnC+CQ4QuA8Q==",
+      "integrity": "sha512-HiNOO3MqLxlt5Da5bZbLV8Zarnphi4y9XehrbaFMkcoJ+FL7sMxH/UlUsCVxpddVu4qvNDrBdaTVE2o4ITK8ng==",
       "license": "MIT",
       "dependencies": {
         "@octokit/oauth-authorization-url": "^8.0.0",
-        "@octokit/request": "^10.0.5",
+        "@octokit/request": "^10.0.6",
-        "@octokit/request-error": "^7.0.1",
+        "@octokit/request-error": "^7.0.2",
-        "@octokit/types": "^15.0.0"
+        "@octokit/types": "^16.0.0"
       },
       "engines": {
         "node": ">= 20"
@@ -810,20 +810,20 @@
       }
     },
     "node_modules/@octokit/openapi-types": {
-      "version": "26.0.0",
+      "version": "27.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-26.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
-      "integrity": "sha512-7AtcfKtpo77j7Ts73b4OWhOZHTKo/gGY8bB3bNBQz4H+GRSWqx2yvj8TXRsbdTE0eRmYmXOEY66jM7mJ7LzfsA==",
+      "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==",
       "license": "MIT"
     },
     "node_modules/@octokit/request": {
-      "version": "10.0.5",
+      "version": "10.0.7",
-      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.5.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.7.tgz",
-      "integrity": "sha512-TXnouHIYLtgDhKo+N6mXATnDBkV05VwbR0TtMWpgTHIoQdRQfCSzmy/LGqR1AbRMbijq/EckC/E3/ZNcU92NaQ==",
+      "integrity": "sha512-v93h0i1yu4idj8qFPZwjehoJx4j3Ntn+JhXsdJrG9pYaX6j/XRz2RmasMUHtNgQD39nrv/VwTWSqK0RNXR8upA==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/endpoint": "^11.0.1",
+        "@octokit/endpoint": "^11.0.2",
-        "@octokit/request-error": "^7.0.1",
+        "@octokit/request-error": "^7.0.2",
-        "@octokit/types": "^15.0.0",
+        "@octokit/types": "^16.0.0",
         "fast-content-type-parse": "^3.0.0",
         "universal-user-agent": "^7.0.2"
       },
@@ -832,24 +832,24 @@
       }
     },
     "node_modules/@octokit/request-error": {
-      "version": "7.0.1",
+      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
-      "integrity": "sha512-CZpFwV4+1uBrxu7Cw8E5NCXDWFNf18MSY23TdxCBgjw1tXXHvTrZVsXlW8hgFTOLw8RQR1BBrMvYRtuyaijHMA==",
+      "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^15.0.0"
+        "@octokit/types": "^16.0.0"
       },
       "engines": {
         "node": ">= 20"
       }
     },
     "node_modules/@octokit/types": {
-      "version": "15.0.0",
+      "version": "16.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-15.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
-      "integrity": "sha512-8o6yDfmoGJUIeR9OfYU0/TUJTnMPG2r68+1yEdUeG2Fdqpj8Qetg0ziKIgcBm0RW/j29H41WP37CYCEhp6GoHQ==",
+      "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/openapi-types": "^26.0.0"
+        "@octokit/openapi-types": "^27.0.0"
       }
     },
     "node_modules/@pkgjs/parseargs": {
@@ -985,7 +985,6 @@
       "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },

package.json

@@ -2,7 +2,7 @@
   "name": "create-github-app-token",
   "private": true,
   "type": "module",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "GitHub Action for creating a GitHub App Installation Access Token",
   "engines": {
     "node": ">=20"
@@ -17,7 +17,7 @@
   "license": "MIT",
   "dependencies": {
     "@actions/core": "^1.11.1",
-    "@octokit/auth-app": "^8.1.1",
+    "@octokit/auth-app": "^8.1.2",
     "@octokit/request": "^10.0.3",
     "p-retry": "^7.1.0",
     "undici": "^7.16.0"

post.js

@@ -4,9 +4,13 @@ import core from "@actions/core";
 
 import { post } from "./lib/post.js";
 import request from "./lib/request.js";
+import { runWithProxy } from "./lib/run-with-proxy.js";
 
-post(core, request).catch((error) => {
+// Export promise for testing
+export default runWithProxy(async () => {
+  return post(core, request).catch((error) => {
     /* c8 ignore next 3 */
     console.error(error);
     core.setFailed(error.message);
+  });
 });

tests/index.js

@@ -22,7 +22,15 @@ for (const file of testFiles) {
       GITHUB_OUTPUT: undefined,
       GITHUB_STATE: undefined,
     };
-    const { stderr, stdout } = await execa("node", [`tests/${file}`], { env });
+    const { stderr, stdout } = await execa(
+      "node",
+      [
+        "--experimental-test-module-mocks",
+        "--disable-warning=ExperimentalWarning",
+        `tests/${file}`,
+      ],
+      { env },
+    );
     t.snapshot(stderr, "stderr");
     t.snapshot(stdout, "stdout");
   });

tests/main-proxy-already-enabled.test.js

@@ -0,0 +1,20 @@
+// Verify that `runWithProxy()` calls the callback directly (no child process)
+// when `NODE_USE_ENV_PROXY` is already set to `"1"`, even with proxy env vars set.
+import assert from "node:assert";
+import { runWithProxy } from "../lib/run-with-proxy.js";
+
+process.env.https_proxy = "http://proxy.example.com";
+process.env.NODE_USE_ENV_PROXY = "1";
+
+let callbackCalled = false;
+
+await runWithProxy(async () => {
+  callbackCalled = true;
+});
+
+assert(callbackCalled, "callback was called directly without spawning");
+
+delete process.env.NODE_USE_ENV_PROXY;
+delete process.env.https_proxy;
+
+

tests/main-proxy-child-error.test.js

@@ -0,0 +1,30 @@
+// Verify that `main.js` rejects when the child process exits with a non-zero code.
+import assert from "node:assert";
+import { mock } from "node:test";
+
+mock.module("node:child_process", {
+  namedExports: {
+    spawn() {
+      return {
+        on(event, callback) {
+          if (event === "exit") callback(1);
+        },
+      };
+    },
+  },
+});
+
+process.env.GITHUB_REPOSITORY = "actions/create-github-app-token";
+process.env.GITHUB_REPOSITORY_OWNER = "actions";
+process.env.https_proxy = "http://proxy.example.com";
+delete process.env.NODE_USE_ENV_PROXY;
+
+const { default: runPromise } = await import("../main.js");
+
+await assert.rejects(runPromise, {
+  message: "Child process exited with code 1",
+});
+assert.equal(process.exitCode, 1, "process exit code is 1");
+
+// Reset for other tests
+process.exitCode = 0;

tests/main-proxy-spawns-child.test.js

@@ -0,0 +1,36 @@
+// Verify that `main.js` spawns a child process when a proxy env var is set
+// and `NODE_USE_ENV_PROXY` is not set.
+import assert from "node:assert";
+import { mock } from "node:test";
+
+let spawnArgs;
+
+mock.module("node:child_process", {
+  namedExports: {
+    spawn(command, args, options) {
+      spawnArgs = { command, args, options };
+      return {
+        on(event, callback) {
+          if (event === "exit") callback(0);
+        },
+      };
+    },
+  },
+});
+
+process.env.GITHUB_REPOSITORY = "actions/create-github-app-token";
+process.env.GITHUB_REPOSITORY_OWNER = "actions";
+process.env.https_proxy = "http://proxy.example.com";
+delete process.env.NODE_USE_ENV_PROXY;
+
+const { default: runPromise } = await import("../main.js");
+await runPromise;
+
+assert(spawnArgs, "spawn was called");
+assert.equal(
+  spawnArgs.options.env.NODE_USE_ENV_PROXY,
+  "1",
+  "NODE_USE_ENV_PROXY is set to '1' in child env",
+);
+assert.equal(spawnArgs.options.stdio, "inherit", "stdio is inherited");
+assert.equal(process.exitCode, 0, "process exit code is 0");

tests/post-proxy-already-enabled.test.js

@@ -0,0 +1,21 @@
+// Verify that `runWithProxy()` calls the callback directly (no child process)
+// when `NODE_USE_ENV_PROXY` is already set to `"1"`, even with proxy env vars set.
+// This ensures post.js would also follow the callback path.
+import assert from "node:assert";
+import { runWithProxy } from "../lib/run-with-proxy.js";
+
+process.env.HTTP_PROXY = "http://proxy.example.com";
+process.env.NODE_USE_ENV_PROXY = "1";
+
+let callbackCalled = false;
+
+await runWithProxy(async () => {
+  callbackCalled = true;
+});
+
+assert(callbackCalled, "callback was called directly without spawning");
+
+delete process.env.NODE_USE_ENV_PROXY;
+delete process.env.HTTP_PROXY;
+
+

tests/post-proxy-spawns-child.test.js

@@ -0,0 +1,34 @@
+// Verify that `post.js` spawns a child process when a proxy env var is set
+// and `NODE_USE_ENV_PROXY` is not set.
+import assert from "node:assert";
+import { mock } from "node:test";
+
+let spawnArgs;
+
+mock.module("node:child_process", {
+  namedExports: {
+    spawn(command, args, options) {
+      spawnArgs = { command, args, options };
+      return {
+        on(event, callback) {
+          if (event === "exit") callback(0);
+        },
+      };
+    },
+  },
+});
+
+process.env.https_proxy = "http://proxy.example.com";
+delete process.env.NODE_USE_ENV_PROXY;
+
+const { default: runPromise } = await import("../post.js");
+await runPromise;
+
+assert(spawnArgs, "spawn was called");
+assert.equal(
+  spawnArgs.options.env.NODE_USE_ENV_PROXY,
+  "1",
+  "NODE_USE_ENV_PROXY is set to '1' in child env",
+);
+assert.equal(spawnArgs.options.stdio, "inherit", "stdio is inherited");
+assert.equal(process.exitCode, 0, "process exit code is 0");

tests/snapshots/index.js.md

@@ -82,6 +82,36 @@ Generated by [AVA](https://avajs.dev).
     POST /app/installations/123456/access_tokens␊
     {"repositories":["create-github-app-token"]}`
 
+## main-proxy-already-enabled.test.js
+
+> stderr
+
+    ''
+
+> stdout
+
+    ''
+
+## main-proxy-child-error.test.js
+
+> stderr
+
+    ''
+
+> stdout
+
+    ''
+
+## main-proxy-spawns-child.test.js
+
+> stderr
+
+    ''
+
+> stdout
+
+    ''
+
 ## main-repo-skew.test.js
 
 > stderr
@@ -333,6 +363,26 @@ Generated by [AVA](https://avajs.dev).
     POST /app/installations/123456/access_tokens␊
     {"repositories":["create-github-app-token"],"permissions":{"issues":"write","pull_requests":"read"}}`
 
+## post-proxy-already-enabled.test.js
+
+> stderr
+
+    ''
+
+> stdout
+
+    ''
+
+## post-proxy-spawns-child.test.js
+
+> stderr
+
+    ''
+
+> stdout
+
+    ''
+
 ## post-revoke-token-fail-response.test.js
 
 > stderr