secure actions execution context

src/config.ts

@@ -45,42 +45,43 @@ export async function resolvePublishActionOptions(): Promise<PublishActionOption
     throw new Error(`Could not find event name.`)
   }
 
-  // Environment Variables
-  const ref: string = process.env.GITHUB_REF || ''
+  const ref: string = github.context.ref || ''
   if (ref === '') {
     throw new Error(`Could not find GITHUB_REF.`)
   }
 
+  const nameWithOwner: string =
+    github.context.payload.repository?.full_name || ''
+  if (nameWithOwner === '') {
+    throw new Error(`Could not find Repository.`)
+  }
+
+  const sha: string = github.context.sha || ''
+  if (sha === '') {
+    throw new Error(`Could not find GITHUB_SHA.`)
+  }
+
+  const apiBaseUrl: string = github.context.apiUrl || ''
+  if (apiBaseUrl === '') {
+    throw new Error(`Could not find GITHUB_API_URL.`)
+  }
+
+  const githubServerUrl = github.context.serverUrl || ''
+  if (githubServerUrl === '') {
+    throw new Error(`Could not find GITHUB_SERVER_URL.`)
+  }
+
+  // Environment Variables
   const workspaceDir: string = process.env.GITHUB_WORKSPACE || ''
   if (workspaceDir === '') {
     throw new Error(`Could not find GITHUB_WORKSPACE.`)
   }
 
-  const nameWithOwner: string = process.env.GITHUB_REPOSITORY || ''
-  if (nameWithOwner === '') {
-    throw new Error(`Could not find Repository.`)
-  }
-
-  const apiBaseUrl: string = process.env.GITHUB_API_URL || ''
-  if (apiBaseUrl === '') {
-    throw new Error(`Could not find GITHUB_API_URL.`)
-  }
-
   const runnerTempDir: string = process.env.RUNNER_TEMP || ''
   if (runnerTempDir === '') {
     throw new Error(`Could not find RUNNER_TEMP.`)
   }
 
-  const sha: string = process.env.GITHUB_SHA || ''
-  if (sha === '') {
-    throw new Error(`Could not find GITHUB_SHA.`)
-  }
-
-  const githubServerUrl = process.env.GITHUB_SERVER_URL || ''
-  if (githubServerUrl === '') {
-    throw new Error(`Could not find GITHUB_SERVER_URL.`)
-  }
-
   const repositoryId = process.env.GITHUB_REPOSITORY_ID || ''
   if (repositoryId === '') {
     throw new Error(`Could not find GITHUB_REPOSITORY_ID.`)

src/fs-helper.ts

@@ -129,14 +129,25 @@ export async function ensureTagAndRefCheckedOut(
 
   const git: simpleGit.SimpleGit = simpleGit.simpleGit(gitDir)
 
-  const tagCommitSha = await git.raw(['rev-parse', '--verify', tagRef])
+  let tagCommitSha: string
+
+  try {
+    tagCommitSha = await git.raw(['rev-parse', '--verify', tagRef])
+  } catch (err) {
+    throw new Error(`Error retrieving commit associated with tag: ${err}`)
+  }
   if (tagCommitSha.trim() !== expectedSha) {
     throw new Error(
       `The commit associated with the tag ${tagRef} does not match the SHA of the commit provided by the actions context.`
     )
   }
 
-  const currentlyCheckedOutSha = await git.revparse(['HEAD'])
+  let currentlyCheckedOutSha: string
+  try {
+    currentlyCheckedOutSha = await git.revparse(['HEAD'])
+  } catch (err) {
+    throw new Error(`Error validating checked out tag and ref: ${err}`)
+  }
   if (currentlyCheckedOutSha.trim() !== expectedSha) {
     throw new Error(
       `The expected commit associated with the tag ${tagRef} is not checked out.`