secure actions execution context

__tests__/config.test.ts

@@ -48,7 +48,7 @@ describe('config.resolvePublishActionOptions', () => {
 
   it('throws an error when the ref is not provided', async () => {
     getInputMock.mockReturnValueOnce('token')
-    process.env.GITHUB_REF = ''
+    github.context.ref = ''
 
     await expect(cfg.resolvePublishActionOptions()).rejects.toThrow(
       'Could not find GITHUB_REF.'
@@ -66,7 +66,7 @@ describe('config.resolvePublishActionOptions', () => {
 
   it('throws an error when the repository is not provided', async () => {
     getInputMock.mockReturnValueOnce('token')
-    process.env.GITHUB_REPOSITORY = ''
+    github.context.payload.repository = undefined
 
     await expect(cfg.resolvePublishActionOptions()).rejects.toThrow(
       'Could not find Repository.'
@@ -75,7 +75,7 @@ describe('config.resolvePublishActionOptions', () => {
 
   it('throws an error when the apiBaseUrl is not provided', async () => {
     getInputMock.mockReturnValueOnce('token')
-    process.env.GITHUB_API_URL = ''
+    github.context.apiUrl = ''
 
     await expect(cfg.resolvePublishActionOptions()).rejects.toThrow(
       'Could not find GITHUB_API_URL.'
@@ -93,7 +93,7 @@ describe('config.resolvePublishActionOptions', () => {
 
   it('throws an error when the sha is not provided', async () => {
     getInputMock.mockReturnValueOnce('token')
-    process.env.GITHUB_SHA = ''
+    github.context.sha = ''
 
     await expect(cfg.resolvePublishActionOptions()).rejects.toThrow(
       'Could not find GITHUB_SHA.'
@@ -102,7 +102,7 @@ describe('config.resolvePublishActionOptions', () => {
 
   it('throws an error when the githubServerUrl is not provided', async () => {
     getInputMock.mockReturnValueOnce('token')
-    process.env.GITHUB_SERVER_URL = ''
+    github.context.serverUrl = ''
 
     await expect(cfg.resolvePublishActionOptions()).rejects.toThrow(
       'Could not find GITHUB_SERVER_URL.'
@@ -235,7 +235,7 @@ describe('config.resolvePublishActionOptions', () => {
       ownerId: 'repositoryOwnerId'
     })
 
-    process.env.GITHUB_SERVER_URL = 'https://github-enterprise.com'
+    github.context.serverUrl = 'https://github-enterprise.com'
 
     const options = await cfg.resolvePublishActionOptions()
 
@@ -296,27 +296,36 @@ describe('config.serializeOptions', () => {
 })
 
 function configureEventContext(): void {
-  process.env.GITHUB_REF = 'ref'
-  process.env.GITHUB_WORKSPACE = 'workspaceDir'
-  process.env.GITHUB_REPOSITORY = 'nameWithOwner'
-  process.env.GITHUB_API_URL = 'apiBaseUrl'
+  github.context.ref = 'ref'
+  github.context.eventName = 'release'
+  github.context.apiUrl = 'apiBaseUrl'
+  github.context.sha = 'sha'
+  github.context.serverUrl = 'https://github.com/'
+  github.context.payload = {
+    repository: {
+      full_name: 'nameWithOwner',
+      name: 'name',
+      owner: {
+        login: 'owner'
+      }
+    }
+  }
+
   process.env.RUNNER_TEMP = 'runnerTempDir'
-  process.env.GITHUB_SHA = 'sha'
-  process.env.GITHUB_SERVER_URL = 'https://github.com/'
+  process.env.GITHUB_WORKSPACE = 'workspaceDir'
   process.env.GITHUB_REPOSITORY_ID = 'repositoryId'
   process.env.GITHUB_REPOSITORY_OWNER_ID = 'repositoryOwnerId'
-  github.context.eventName = 'release'
 }
 
 function clearEventContext(): void {
-  process.env.GITHUB_REF = ''
-  process.env.GITHUB_WORKSPACE = ''
-  process.env.GITHUB_REPOSITORY = ''
-  process.env.GITHUB_API_URL = ''
+  github.context.ref = ''
+  github.context.eventName = ''
+  github.context.apiUrl = ''
+  github.context.sha = ''
+  github.context.serverUrl = ''
+  github.context.payload = {}
   process.env.RUNNER_TEMP = ''
-  process.env.GITHUB_SHA = ''
-  process.env.GITHUB_SERVER_URL = ''
+  process.env.GITHUB_WORKSPACE = ''
   process.env.GITHUB_REPOSITORY_ID = ''
   process.env.GITHUB_REPOSITORY_OWNER_ID = ''
-  github.context.eventName = ''
 }

__tests__/fs-helper.test.ts

@@ -256,18 +256,32 @@ describe('ensureCorrectShaCheckedOut', () => {
   it('throws an error if the correct SHA is not checked out', async () => {
     await expect(
       fsHelper.ensureTagAndRefCheckedOut(`refs/tags/${tag1}`, commit1, dir)
-    ).rejects.toThrow()
+    ).rejects.toThrow(
+      'The expected commit associated with the tag refs/tags/tag1 is not checked out.'
+    )
+  })
+
+  it('throws if there is an issue getting sha for tag', async () => {
+    await expect(async () =>
+      fsHelper.ensureTagAndRefCheckedOut(
+        `refs/tags/some-unknown-tag`,
+        commit2,
+        dir
+      )
+    ).rejects.toThrow('Error retrieving commit associated with tag')
   })
 
   it('throws an error if the sha of the tag does not match expected sha', async () => {
     await expect(async () =>
       fsHelper.ensureTagAndRefCheckedOut(`refs/tags/${tag1}`, commit2, dir)
-    ).rejects.toThrow()
+    ).rejects.toThrow(
+      'The commit associated with the tag refs/tags/tag1 does not match the SHA of the commit provided by the actions context.'
+    )
   })
 
   it('throws if the provided ref is not a tag ref', async () => {
     await expect(async () =>
       fsHelper.ensureTagAndRefCheckedOut(`refs/heads/main`, commit2, dir)
-    ).rejects.toThrow()
+    ).rejects.toThrow('Tag ref provided is not in expected format.')
   })
 })