@cloudsnorkel/cdk-github-runners 0.3.1 → 0.3.2

package/lib/lambdas/setup/index.js

@@ -5753,7 +5753,7 @@ var require_lib2 = __commonJS({
       var trail = encoder.end();
       return trail && trail.length > 0 ? Buffer2.concat([res, trail]) : res;
     };
-    iconv.decode = function decode2(buf, encoding, options) {
+    iconv.decode = function decode(buf, encoding, options) {
       if (typeof buf === "string") {
         if (!iconv.skipDecodeWarning) {
           console.error("Iconv-lite warning: decode()-ing strings is deprecated. Refer to https://github.com/ashtuchkin/iconv-lite/wiki/Use-Buffers-when-decoding");
@@ -6795,16 +6795,16 @@ var require_lib3 = __commonJS({
         const options = getNodeRequestOptions(request);
         const send = (options.protocol === "https:" ? https : http).request;
         const signal = request.signal;
-        let response = null;
+        let response2 = null;
         const abort = function abort2() {
           let error = new AbortError("The user aborted a request.");
           reject(error);
           if (request.body && request.body instanceof Stream.Readable) {
             request.body.destroy(error);
           }
-          if (!response || !response.body)
+          if (!response2 || !response2.body)
             return;
-          response.body.emit("error", error);
+          response2.body.emit("error", error);
         };
         if (signal && signal.aborted) {
           abort();
@@ -6923,8 +6923,8 @@ var require_lib3 = __commonJS({
           };
           const codings = headers.get("Content-Encoding");
           if (!request.compress || request.method === "HEAD" || codings === null || res.statusCode === 204 || res.statusCode === 304) {
-            response = new Response(body, response_options);
-            resolve(response);
+            response2 = new Response(body, response_options);
+            resolve(response2);
             return;
           }
           const zlibOptions = {
@@ -6933,8 +6933,8 @@ var require_lib3 = __commonJS({
           };
           if (codings == "gzip" || codings == "x-gzip") {
             body = body.pipe(zlib.createGunzip(zlibOptions));
-            response = new Response(body, response_options);
-            resolve(response);
+            response2 = new Response(body, response_options);
+            resolve(response2);
             return;
           }
           if (codings == "deflate" || codings == "x-deflate") {
@@ -6945,19 +6945,19 @@ var require_lib3 = __commonJS({
               } else {
                 body = body.pipe(zlib.createInflateRaw());
               }
-              response = new Response(body, response_options);
-              resolve(response);
+              response2 = new Response(body, response_options);
+              resolve(response2);
             });
             return;
           }
           if (codings == "br" && typeof zlib.createBrotliDecompress === "function") {
             body = body.pipe(zlib.createBrotliDecompress());
-            response = new Response(body, response_options);
-            resolve(response);
+            response2 = new Response(body, response_options);
+            resolve(response2);
             return;
           }
-          response = new Response(body, response_options);
-          resolve(response);
+          response2 = new Response(body, response_options);
+          resolve(response2);
         });
         writeToStream(req, request);
       });
@@ -7138,8 +7138,8 @@ var require_dist_node5 = __commonJS({
     var nodeFetch = _interopDefault(require_lib3());
     var requestError = require_dist_node4();
     var VERSION = "5.6.3";
-    function getBufferResponse(response) {
-      return response.arrayBuffer();
+    function getBufferResponse(response2) {
+      return response2.arrayBuffer();
     }
     function fetchWrapper(requestOptions) {
       const log = requestOptions.request && requestOptions.request.log ? requestOptions.request.log : console;
@@ -7155,10 +7155,10 @@ var require_dist_node5 = __commonJS({
         body: requestOptions.body,
         headers: requestOptions.headers,
         redirect: requestOptions.redirect
-      }, requestOptions.request)).then(async (response) => {
-        url = response.url;
-        status = response.status;
-        for (const keyAndValue of response.headers) {
+      }, requestOptions.request)).then(async (response2) => {
+        url = response2.url;
+        status = response2.status;
+        for (const keyAndValue of response2.headers) {
           headers[keyAndValue[0]] = keyAndValue[1];
         }
         if ("deprecation" in headers) {
@@ -7173,7 +7173,7 @@ var require_dist_node5 = __commonJS({
           if (status < 400) {
             return;
           }
-          throw new requestError.RequestError(response.statusText, status, {
+          throw new requestError.RequestError(response2.statusText, status, {
             response: {
               url,
               status,
@@ -7189,13 +7189,13 @@ var require_dist_node5 = __commonJS({
               url,
               status,
               headers,
-              data: await getResponseData(response)
+              data: await getResponseData(response2)
             },
             request: requestOptions
           });
         }
         if (status >= 400) {
-          const data = await getResponseData(response);
+          const data = await getResponseData(response2);
           const error = new requestError.RequestError(toErrorMessage(data), status, {
             response: {
               url,
@@ -7207,7 +7207,7 @@ var require_dist_node5 = __commonJS({
           });
           throw error;
         }
-        return getResponseData(response);
+        return getResponseData(response2);
       }).then((data) => {
         return {
           status,
@@ -7223,15 +7223,15 @@ var require_dist_node5 = __commonJS({
         });
       });
     }
-    async function getResponseData(response) {
-      const contentType = response.headers.get("content-type");
+    async function getResponseData(response2) {
+      const contentType = response2.headers.get("content-type");
       if (/application\/json/.test(contentType)) {
-        return response.json();
+        return response2.json();
       }
       if (!contentType || /^text\/|charset=utf-8$/.test(contentType)) {
-        return response.text();
+        return response2.text();
       }
-      return getBufferResponse(response);
+      return getBufferResponse(response2);
     }
     function toErrorMessage(data) {
       if (typeof data === "string")
@@ -7287,14 +7287,14 @@ var require_dist_node6 = __commonJS({
 ` + data.errors.map((e) => ` - ${e.message}`).join("\n");
     }
     var GraphqlResponseError = class extends Error {
-      constructor(request2, headers, response) {
-        super(_buildMessageForResponseErrors(response));
+      constructor(request2, headers, response2) {
+        super(_buildMessageForResponseErrors(response2));
         this.request = request2;
         this.headers = headers;
-        this.response = response;
+        this.response = response2;
         this.name = "GraphqlResponseError";
-        this.errors = response.errors;
-        this.data = response.data;
+        this.errors = response2.errors;
+        this.data = response2.data;
         if (Error.captureStackTrace) {
           Error.captureStackTrace(this, this.constructor);
         }
@@ -7332,15 +7332,15 @@ var require_dist_node6 = __commonJS({
       if (GHES_V3_SUFFIX_REGEX.test(baseUrl)) {
         requestOptions.url = baseUrl.replace(GHES_V3_SUFFIX_REGEX, "/api/graphql");
       }
-      return request2(requestOptions).then((response) => {
-        if (response.data.errors) {
+      return request2(requestOptions).then((response2) => {
+        if (response2.data.errors) {
           const headers = {};
-          for (const key of Object.keys(response.headers)) {
-            headers[key] = response.headers[key];
+          for (const key of Object.keys(response2.headers)) {
+            headers[key] = response2.headers[key];
           }
-          throw new GraphqlResponseError(requestOptions, headers, response.data);
+          throw new GraphqlResponseError(requestOptions, headers, response2.data);
         }
-        return response.data.data;
+        return response2.data.data;
       });
     }
     function withDefaults(request$1, newDefaults) {
@@ -7566,9 +7566,9 @@ var require_dist_node9 = __commonJS({
         const start = Date.now();
         const requestOptions = octokit.request.endpoint.parse(options);
         const path = requestOptions.url.replace(options.baseUrl, "");
-        return request(options).then((response) => {
-          octokit.log.info(`${requestOptions.method} ${path} - ${response.status} in ${Date.now() - start}ms`);
-          return response;
+        return request(options).then((response2) => {
+          octokit.log.info(`${requestOptions.method} ${path} - ${response2.status} in ${Date.now() - start}ms`);
+          return response2;
         }).catch((error) => {
           octokit.log.info(`${requestOptions.method} ${path} - ${error.status} in ${Date.now() - start}ms`);
           throw error;
@@ -7585,7 +7585,7 @@ var require_dist_node10 = __commonJS({
   "node_modules/@octokit/plugin-paginate-rest/dist-node/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    var VERSION = "2.20.0";
+    var VERSION = "2.21.3";
     function ownKeys(object, enumerableOnly) {
       var keys = Object.keys(object);
       if (Object.getOwnPropertySymbols) {
@@ -7598,7 +7598,7 @@ var require_dist_node10 = __commonJS({
     }
     function _objectSpread2(target) {
       for (var i = 1; i < arguments.length; i++) {
-        var source = arguments[i] != null ? arguments[i] : {};
+        var source = null != arguments[i] ? arguments[i] : {};
         i % 2 ? ownKeys(Object(source), true).forEach(function(key) {
           _defineProperty(target, key, source[key]);
         }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)) : ownKeys(Object(source)).forEach(function(key) {
@@ -7620,32 +7620,32 @@ var require_dist_node10 = __commonJS({
       }
       return obj;
     }
-    function normalizePaginatedListResponse(response) {
-      if (!response.data) {
-        return _objectSpread2(_objectSpread2({}, response), {}, {
+    function normalizePaginatedListResponse(response2) {
+      if (!response2.data) {
+        return _objectSpread2(_objectSpread2({}, response2), {}, {
           data: []
         });
       }
-      const responseNeedsNormalization = "total_count" in response.data && !("url" in response.data);
+      const responseNeedsNormalization = "total_count" in response2.data && !("url" in response2.data);
       if (!responseNeedsNormalization)
-        return response;
-      const incompleteResults = response.data.incomplete_results;
-      const repositorySelection = response.data.repository_selection;
-      const totalCount = response.data.total_count;
-      delete response.data.incomplete_results;
-      delete response.data.repository_selection;
-      delete response.data.total_count;
-      const namespaceKey = Object.keys(response.data)[0];
-      const data = response.data[namespaceKey];
-      response.data = data;
+        return response2;
+      const incompleteResults = response2.data.incomplete_results;
+      const repositorySelection = response2.data.repository_selection;
+      const totalCount = response2.data.total_count;
+      delete response2.data.incomplete_results;
+      delete response2.data.repository_selection;
+      delete response2.data.total_count;
+      const namespaceKey = Object.keys(response2.data)[0];
+      const data = response2.data[namespaceKey];
+      response2.data = data;
       if (typeof incompleteResults !== "undefined") {
-        response.data.incomplete_results = incompleteResults;
+        response2.data.incomplete_results = incompleteResults;
       }
       if (typeof repositorySelection !== "undefined") {
-        response.data.repository_selection = repositorySelection;
+        response2.data.repository_selection = repositorySelection;
       }
-      response.data.total_count = totalCount;
-      return response;
+      response2.data.total_count = totalCount;
+      return response2;
     }
     function iterator(octokit, route, parameters) {
       const options = typeof route === "function" ? route.endpoint(parameters) : octokit.request.endpoint(route, parameters);
@@ -7661,12 +7661,12 @@ var require_dist_node10 = __commonJS({
                 done: true
               };
             try {
-              const response = await requestMethod({
+              const response2 = await requestMethod({
                 method,
                 url,
                 headers
               });
-              const normalizedResponse = normalizePaginatedListResponse(response);
+              const normalizedResponse = normalizePaginatedListResponse(response2);
               url = ((normalizedResponse.headers.link || "").match(/<([^>]+)>;\s*rel="next"/) || [])[1];
               return {
                 value: normalizedResponse
@@ -7713,7 +7713,7 @@ var require_dist_node10 = __commonJS({
     var composePaginateRest = Object.assign(paginate, {
       iterator
     });
-    var paginatingEndpoints = ["GET /app/hook/deliveries", "GET /app/installations", "GET /applications/grants", "GET /authorizations", "GET /enterprises/{enterprise}/actions/permissions/organizations", "GET /enterprises/{enterprise}/actions/runner-groups", "GET /enterprises/{enterprise}/actions/runner-groups/{runner_group_id}/organizations", "GET /enterprises/{enterprise}/actions/runner-groups/{runner_group_id}/runners", "GET /enterprises/{enterprise}/actions/runners", "GET /enterprises/{enterprise}/actions/runners/downloads", "GET /enterprises/{enterprise}/actions/runners/{runner_id}/labels", "GET /enterprises/{enterprise}/secret-scanning/alerts", "GET /events", "GET /gists", "GET /gists/public", "GET /gists/starred", "GET /gists/{gist_id}/comments", "GET /gists/{gist_id}/commits", "GET /gists/{gist_id}/forks", "GET /installation/repositories", "GET /issues", "GET /marketplace_listing/plans", "GET /marketplace_listing/plans/{plan_id}/accounts", "GET /marketplace_listing/stubbed/plans", "GET /marketplace_listing/stubbed/plans/{plan_id}/accounts", "GET /networks/{owner}/{repo}/events", "GET /notifications", "GET /organizations", "GET /organizations/{organization_id}/custom_roles", "GET /orgs/{org_id}/codespaces", "GET /orgs/{org}/actions/permissions/repositories", "GET /orgs/{org}/actions/runner-groups", "GET /orgs/{org}/actions/runner-groups/{runner_group_id}/repositories", "GET /orgs/{org}/actions/runner-groups/{runner_group_id}/runners", "GET /orgs/{org}/actions/runners", "GET /orgs/{org}/actions/runners/downloads", "GET /orgs/{org}/actions/runners/{runner_id}/labels", "GET /orgs/{org}/actions/secrets", "GET /orgs/{org}/actions/secrets/{secret_name}/repositories", "GET /orgs/{org}/blocks", "GET /orgs/{org}/code-scanning/alerts", "GET /orgs/{org}/credential-authorizations", "GET /orgs/{org}/dependabot/secrets", "GET /orgs/{org}/dependabot/secrets/{secret_name}/repositories", "GET /orgs/{org}/events", "GET /orgs/{org}/external-groups", "GET /orgs/{org}/failed_invitations", "GET /orgs/{org}/hooks", "GET /orgs/{org}/hooks/{hook_id}/deliveries", "GET /orgs/{org}/installations", "GET /orgs/{org}/invitations", "GET /orgs/{org}/invitations/{invitation_id}/teams", "GET /orgs/{org}/issues", "GET /orgs/{org}/members", "GET /orgs/{org}/migrations", "GET /orgs/{org}/migrations/{migration_id}/repositories", "GET /orgs/{org}/outside_collaborators", "GET /orgs/{org}/packages", "GET /orgs/{org}/projects", "GET /orgs/{org}/public_members", "GET /orgs/{org}/repos", "GET /orgs/{org}/secret-scanning/alerts", "GET /orgs/{org}/team-sync/groups", "GET /orgs/{org}/teams", "GET /orgs/{org}/teams/{team_slug}/discussions", "GET /orgs/{org}/teams/{team_slug}/discussions/{discussion_number}/comments", "GET /orgs/{org}/teams/{team_slug}/discussions/{discussion_number}/comments/{comment_number}/reactions", "GET /orgs/{org}/teams/{team_slug}/discussions/{discussion_number}/reactions", "GET /orgs/{org}/teams/{team_slug}/external-groups", "GET /orgs/{org}/teams/{team_slug}/invitations", "GET /orgs/{org}/teams/{team_slug}/members", "GET /orgs/{org}/teams/{team_slug}/projects", "GET /orgs/{org}/teams/{team_slug}/repos", "GET /orgs/{org}/teams/{team_slug}/team-sync/group-mappings", "GET /orgs/{org}/teams/{team_slug}/teams", "GET /projects/columns/{column_id}/cards", "GET /projects/{project_id}/collaborators", "GET /projects/{project_id}/columns", "GET /repos/{owner}/{repo}/actions/artifacts", "GET /repos/{owner}/{repo}/actions/runners", "GET /repos/{owner}/{repo}/actions/runners/downloads", "GET /repos/{owner}/{repo}/actions/runners/{runner_id}/labels", "GET /repos/{owner}/{repo}/actions/runs", "GET /repos/{owner}/{repo}/actions/runs/{run_id}/artifacts", "GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt_number}/jobs", "GET /repos/{owner}/{repo}/actions/runs/{run_id}/jobs", "GET /repos/{owner}/{repo}/actions/secrets", "GET /repos/{owner}/{repo}/actions/workflows", "GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs", "GET /repos/{owner}/{repo}/assignees", "GET /repos/{owner}/{repo}/autolinks", "GET /repos/{owner}/{repo}/branches", "GET /repos/{owner}/{repo}/check-runs/{check_run_id}/annotations", "GET /repos/{owner}/{repo}/check-suites/{check_suite_id}/check-runs", "GET /repos/{owner}/{repo}/code-scanning/alerts", "GET /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/instances", "GET /repos/{owner}/{repo}/code-scanning/analyses", "GET /repos/{owner}/{repo}/codespaces", "GET /repos/{owner}/{repo}/codespaces/devcontainers", "GET /repos/{owner}/{repo}/codespaces/secrets", "GET /repos/{owner}/{repo}/collaborators", "GET /repos/{owner}/{repo}/comments", "GET /repos/{owner}/{repo}/comments/{comment_id}/reactions", "GET /repos/{owner}/{repo}/commits", "GET /repos/{owner}/{repo}/commits/{commit_sha}/branches-where-head", "GET /repos/{owner}/{repo}/commits/{commit_sha}/comments", "GET /repos/{owner}/{repo}/commits/{commit_sha}/pulls", "GET /repos/{owner}/{repo}/commits/{ref}/check-runs", "GET /repos/{owner}/{repo}/commits/{ref}/check-suites", "GET /repos/{owner}/{repo}/commits/{ref}/statuses", "GET /repos/{owner}/{repo}/contributors", "GET /repos/{owner}/{repo}/dependabot/secrets", "GET /repos/{owner}/{repo}/deployments", "GET /repos/{owner}/{repo}/deployments/{deployment_id}/statuses", "GET /repos/{owner}/{repo}/events", "GET /repos/{owner}/{repo}/forks", "GET /repos/{owner}/{repo}/git/matching-refs/{ref}", "GET /repos/{owner}/{repo}/hooks", "GET /repos/{owner}/{repo}/hooks/{hook_id}/deliveries", "GET /repos/{owner}/{repo}/invitations", "GET /repos/{owner}/{repo}/issues", "GET /repos/{owner}/{repo}/issues/comments", "GET /repos/{owner}/{repo}/issues/comments/{comment_id}/reactions", "GET /repos/{owner}/{repo}/issues/events", "GET /repos/{owner}/{repo}/issues/{issue_number}/comments", "GET /repos/{owner}/{repo}/issues/{issue_number}/events", "GET /repos/{owner}/{repo}/issues/{issue_number}/labels", "GET /repos/{owner}/{repo}/issues/{issue_number}/reactions", "GET /repos/{owner}/{repo}/issues/{issue_number}/timeline", "GET /repos/{owner}/{repo}/keys", "GET /repos/{owner}/{repo}/labels", "GET /repos/{owner}/{repo}/milestones", "GET /repos/{owner}/{repo}/milestones/{milestone_number}/labels", "GET /repos/{owner}/{repo}/notifications", "GET /repos/{owner}/{repo}/pages/builds", "GET /repos/{owner}/{repo}/projects", "GET /repos/{owner}/{repo}/pulls", "GET /repos/{owner}/{repo}/pulls/comments", "GET /repos/{owner}/{repo}/pulls/comments/{comment_id}/reactions", "GET /repos/{owner}/{repo}/pulls/{pull_number}/comments", "GET /repos/{owner}/{repo}/pulls/{pull_number}/commits", "GET /repos/{owner}/{repo}/pulls/{pull_number}/files", "GET /repos/{owner}/{repo}/pulls/{pull_number}/requested_reviewers", "GET /repos/{owner}/{repo}/pulls/{pull_number}/reviews", "GET /repos/{owner}/{repo}/pulls/{pull_number}/reviews/{review_id}/comments", "GET /repos/{owner}/{repo}/releases", "GET /repos/{owner}/{repo}/releases/{release_id}/assets", "GET /repos/{owner}/{repo}/releases/{release_id}/reactions", "GET /repos/{owner}/{repo}/secret-scanning/alerts", "GET /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}/locations", "GET /repos/{owner}/{repo}/stargazers", "GET /repos/{owner}/{repo}/subscribers", "GET /repos/{owner}/{repo}/tags", "GET /repos/{owner}/{repo}/tags/protection", "GET /repos/{owner}/{repo}/teams", "GET /repositories", "GET /repositories/{repository_id}/environments/{environment_name}/secrets", "GET /scim/v2/enterprises/{enterprise}/Groups", "GET /scim/v2/enterprises/{enterprise}/Users", "GET /scim/v2/organizations/{org}/Users", "GET /search/code", "GET /search/commits", "GET /search/issues", "GET /search/labels", "GET /search/repositories", "GET /search/topics", "GET /search/users", "GET /teams/{team_id}/discussions", "GET /teams/{team_id}/discussions/{discussion_number}/comments", "GET /teams/{team_id}/discussions/{discussion_number}/comments/{comment_number}/reactions", "GET /teams/{team_id}/discussions/{discussion_number}/reactions", "GET /teams/{team_id}/invitations", "GET /teams/{team_id}/members", "GET /teams/{team_id}/projects", "GET /teams/{team_id}/repos", "GET /teams/{team_id}/team-sync/group-mappings", "GET /teams/{team_id}/teams", "GET /user/blocks", "GET /user/codespaces", "GET /user/codespaces/secrets", "GET /user/codespaces/secrets/{secret_name}/repositories", "GET /user/emails", "GET /user/followers", "GET /user/following", "GET /user/gpg_keys", "GET /user/installations", "GET /user/installations/{installation_id}/repositories", "GET /user/issues", "GET /user/keys", "GET /user/marketplace_purchases", "GET /user/marketplace_purchases/stubbed", "GET /user/memberships/orgs", "GET /user/migrations", "GET /user/migrations/{migration_id}/repositories", "GET /user/orgs", "GET /user/packages", "GET /user/public_emails", "GET /user/repos", "GET /user/repository_invitations", "GET /user/starred", "GET /user/subscriptions", "GET /user/teams", "GET /users", "GET /users/{username}/events", "GET /users/{username}/events/orgs/{org}", "GET /users/{username}/events/public", "GET /users/{username}/followers", "GET /users/{username}/following", "GET /users/{username}/gists", "GET /users/{username}/gpg_keys", "GET /users/{username}/keys", "GET /users/{username}/orgs", "GET /users/{username}/packages", "GET /users/{username}/projects", "GET /users/{username}/received_events", "GET /users/{username}/received_events/public", "GET /users/{username}/repos", "GET /users/{username}/starred", "GET /users/{username}/subscriptions"];
+    var paginatingEndpoints = ["GET /app/hook/deliveries", "GET /app/installations", "GET /applications/grants", "GET /authorizations", "GET /enterprises/{enterprise}/actions/permissions/organizations", "GET /enterprises/{enterprise}/actions/runner-groups", "GET /enterprises/{enterprise}/actions/runner-groups/{runner_group_id}/organizations", "GET /enterprises/{enterprise}/actions/runner-groups/{runner_group_id}/runners", "GET /enterprises/{enterprise}/actions/runners", "GET /enterprises/{enterprise}/audit-log", "GET /enterprises/{enterprise}/secret-scanning/alerts", "GET /enterprises/{enterprise}/settings/billing/advanced-security", "GET /events", "GET /gists", "GET /gists/public", "GET /gists/starred", "GET /gists/{gist_id}/comments", "GET /gists/{gist_id}/commits", "GET /gists/{gist_id}/forks", "GET /installation/repositories", "GET /issues", "GET /licenses", "GET /marketplace_listing/plans", "GET /marketplace_listing/plans/{plan_id}/accounts", "GET /marketplace_listing/stubbed/plans", "GET /marketplace_listing/stubbed/plans/{plan_id}/accounts", "GET /networks/{owner}/{repo}/events", "GET /notifications", "GET /organizations", "GET /orgs/{org}/actions/cache/usage-by-repository", "GET /orgs/{org}/actions/permissions/repositories", "GET /orgs/{org}/actions/runner-groups", "GET /orgs/{org}/actions/runner-groups/{runner_group_id}/repositories", "GET /orgs/{org}/actions/runner-groups/{runner_group_id}/runners", "GET /orgs/{org}/actions/runners", "GET /orgs/{org}/actions/secrets", "GET /orgs/{org}/actions/secrets/{secret_name}/repositories", "GET /orgs/{org}/audit-log", "GET /orgs/{org}/blocks", "GET /orgs/{org}/code-scanning/alerts", "GET /orgs/{org}/codespaces", "GET /orgs/{org}/credential-authorizations", "GET /orgs/{org}/dependabot/secrets", "GET /orgs/{org}/dependabot/secrets/{secret_name}/repositories", "GET /orgs/{org}/events", "GET /orgs/{org}/external-groups", "GET /orgs/{org}/failed_invitations", "GET /orgs/{org}/hooks", "GET /orgs/{org}/hooks/{hook_id}/deliveries", "GET /orgs/{org}/installations", "GET /orgs/{org}/invitations", "GET /orgs/{org}/invitations/{invitation_id}/teams", "GET /orgs/{org}/issues", "GET /orgs/{org}/members", "GET /orgs/{org}/migrations", "GET /orgs/{org}/migrations/{migration_id}/repositories", "GET /orgs/{org}/outside_collaborators", "GET /orgs/{org}/packages", "GET /orgs/{org}/packages/{package_type}/{package_name}/versions", "GET /orgs/{org}/projects", "GET /orgs/{org}/public_members", "GET /orgs/{org}/repos", "GET /orgs/{org}/secret-scanning/alerts", "GET /orgs/{org}/settings/billing/advanced-security", "GET /orgs/{org}/team-sync/groups", "GET /orgs/{org}/teams", "GET /orgs/{org}/teams/{team_slug}/discussions", "GET /orgs/{org}/teams/{team_slug}/discussions/{discussion_number}/comments", "GET /orgs/{org}/teams/{team_slug}/discussions/{discussion_number}/comments/{comment_number}/reactions", "GET /orgs/{org}/teams/{team_slug}/discussions/{discussion_number}/reactions", "GET /orgs/{org}/teams/{team_slug}/invitations", "GET /orgs/{org}/teams/{team_slug}/members", "GET /orgs/{org}/teams/{team_slug}/projects", "GET /orgs/{org}/teams/{team_slug}/repos", "GET /orgs/{org}/teams/{team_slug}/teams", "GET /projects/columns/{column_id}/cards", "GET /projects/{project_id}/collaborators", "GET /projects/{project_id}/columns", "GET /repos/{owner}/{repo}/actions/artifacts", "GET /repos/{owner}/{repo}/actions/caches", "GET /repos/{owner}/{repo}/actions/runners", "GET /repos/{owner}/{repo}/actions/runs", "GET /repos/{owner}/{repo}/actions/runs/{run_id}/artifacts", "GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt_number}/jobs", "GET /repos/{owner}/{repo}/actions/runs/{run_id}/jobs", "GET /repos/{owner}/{repo}/actions/secrets", "GET /repos/{owner}/{repo}/actions/workflows", "GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs", "GET /repos/{owner}/{repo}/assignees", "GET /repos/{owner}/{repo}/branches", "GET /repos/{owner}/{repo}/check-runs/{check_run_id}/annotations", "GET /repos/{owner}/{repo}/check-suites/{check_suite_id}/check-runs", "GET /repos/{owner}/{repo}/code-scanning/alerts", "GET /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/instances", "GET /repos/{owner}/{repo}/code-scanning/analyses", "GET /repos/{owner}/{repo}/codespaces", "GET /repos/{owner}/{repo}/codespaces/devcontainers", "GET /repos/{owner}/{repo}/codespaces/secrets", "GET /repos/{owner}/{repo}/collaborators", "GET /repos/{owner}/{repo}/comments", "GET /repos/{owner}/{repo}/comments/{comment_id}/reactions", "GET /repos/{owner}/{repo}/commits", "GET /repos/{owner}/{repo}/commits/{commit_sha}/comments", "GET /repos/{owner}/{repo}/commits/{commit_sha}/pulls", "GET /repos/{owner}/{repo}/commits/{ref}/check-runs", "GET /repos/{owner}/{repo}/commits/{ref}/check-suites", "GET /repos/{owner}/{repo}/commits/{ref}/status", "GET /repos/{owner}/{repo}/commits/{ref}/statuses", "GET /repos/{owner}/{repo}/contributors", "GET /repos/{owner}/{repo}/dependabot/secrets", "GET /repos/{owner}/{repo}/deployments", "GET /repos/{owner}/{repo}/deployments/{deployment_id}/statuses", "GET /repos/{owner}/{repo}/environments", "GET /repos/{owner}/{repo}/events", "GET /repos/{owner}/{repo}/forks", "GET /repos/{owner}/{repo}/git/matching-refs/{ref}", "GET /repos/{owner}/{repo}/hooks", "GET /repos/{owner}/{repo}/hooks/{hook_id}/deliveries", "GET /repos/{owner}/{repo}/invitations", "GET /repos/{owner}/{repo}/issues", "GET /repos/{owner}/{repo}/issues/comments", "GET /repos/{owner}/{repo}/issues/comments/{comment_id}/reactions", "GET /repos/{owner}/{repo}/issues/events", "GET /repos/{owner}/{repo}/issues/{issue_number}/comments", "GET /repos/{owner}/{repo}/issues/{issue_number}/events", "GET /repos/{owner}/{repo}/issues/{issue_number}/labels", "GET /repos/{owner}/{repo}/issues/{issue_number}/reactions", "GET /repos/{owner}/{repo}/issues/{issue_number}/timeline", "GET /repos/{owner}/{repo}/keys", "GET /repos/{owner}/{repo}/labels", "GET /repos/{owner}/{repo}/milestones", "GET /repos/{owner}/{repo}/milestones/{milestone_number}/labels", "GET /repos/{owner}/{repo}/notifications", "GET /repos/{owner}/{repo}/pages/builds", "GET /repos/{owner}/{repo}/projects", "GET /repos/{owner}/{repo}/pulls", "GET /repos/{owner}/{repo}/pulls/comments", "GET /repos/{owner}/{repo}/pulls/comments/{comment_id}/reactions", "GET /repos/{owner}/{repo}/pulls/{pull_number}/comments", "GET /repos/{owner}/{repo}/pulls/{pull_number}/commits", "GET /repos/{owner}/{repo}/pulls/{pull_number}/files", "GET /repos/{owner}/{repo}/pulls/{pull_number}/requested_reviewers", "GET /repos/{owner}/{repo}/pulls/{pull_number}/reviews", "GET /repos/{owner}/{repo}/pulls/{pull_number}/reviews/{review_id}/comments", "GET /repos/{owner}/{repo}/releases", "GET /repos/{owner}/{repo}/releases/{release_id}/assets", "GET /repos/{owner}/{repo}/releases/{release_id}/reactions", "GET /repos/{owner}/{repo}/secret-scanning/alerts", "GET /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}/locations", "GET /repos/{owner}/{repo}/stargazers", "GET /repos/{owner}/{repo}/subscribers", "GET /repos/{owner}/{repo}/tags", "GET /repos/{owner}/{repo}/teams", "GET /repos/{owner}/{repo}/topics", "GET /repositories", "GET /repositories/{repository_id}/environments/{environment_name}/secrets", "GET /search/code", "GET /search/commits", "GET /search/issues", "GET /search/labels", "GET /search/repositories", "GET /search/topics", "GET /search/users", "GET /teams/{team_id}/discussions", "GET /teams/{team_id}/discussions/{discussion_number}/comments", "GET /teams/{team_id}/discussions/{discussion_number}/comments/{comment_number}/reactions", "GET /teams/{team_id}/discussions/{discussion_number}/reactions", "GET /teams/{team_id}/invitations", "GET /teams/{team_id}/members", "GET /teams/{team_id}/projects", "GET /teams/{team_id}/repos", "GET /teams/{team_id}/teams", "GET /user/blocks", "GET /user/codespaces", "GET /user/codespaces/secrets", "GET /user/emails", "GET /user/followers", "GET /user/following", "GET /user/gpg_keys", "GET /user/installations", "GET /user/installations/{installation_id}/repositories", "GET /user/issues", "GET /user/keys", "GET /user/marketplace_purchases", "GET /user/marketplace_purchases/stubbed", "GET /user/memberships/orgs", "GET /user/migrations", "GET /user/migrations/{migration_id}/repositories", "GET /user/orgs", "GET /user/packages", "GET /user/packages/{package_type}/{package_name}/versions", "GET /user/public_emails", "GET /user/repos", "GET /user/repository_invitations", "GET /user/starred", "GET /user/subscriptions", "GET /user/teams", "GET /users", "GET /users/{username}/events", "GET /users/{username}/events/orgs/{org}", "GET /users/{username}/events/public", "GET /users/{username}/followers", "GET /users/{username}/following", "GET /users/{username}/gists", "GET /users/{username}/gpg_keys", "GET /users/{username}/keys", "GET /users/{username}/orgs", "GET /users/{username}/packages", "GET /users/{username}/projects", "GET /users/{username}/received_events", "GET /users/{username}/received_events/public", "GET /users/{username}/repos", "GET /users/{username}/starred", "GET /users/{username}/subscriptions"];
     function isPaginatingEndpoint(arg) {
       if (typeof arg === "string") {
         return paginatingEndpoints.includes(arg);
@@ -7877,7 +7877,6 @@ var require_dist_node11 = __commonJS({
         removeCustomLabelFromSelfHostedRunnerForRepo: ["DELETE /repos/{owner}/{repo}/actions/runners/{runner_id}/labels/{name}"],
         removeSelectedRepoFromOrgSecret: ["DELETE /orgs/{org}/actions/secrets/{secret_name}/repositories/{repository_id}"],
         reviewPendingDeploymentsForRun: ["POST /repos/{owner}/{repo}/actions/runs/{run_id}/pending_deployments"],
-        setActionsOidcCustomIssuerPolicyForEnterprise: ["PUT /enterprises/{enterprise}/actions/oidc/customization/issuer"],
         setAllowedActionsOrganization: ["PUT /orgs/{org}/actions/permissions/selected-actions"],
         setAllowedActionsRepository: ["PUT /repos/{owner}/{repo}/actions/permissions/selected-actions"],
         setCustomLabelsForSelfHostedRunnerForOrg: ["PUT /orgs/{org}/actions/runners/{runner_id}/labels"],
@@ -8036,7 +8035,11 @@ var require_dist_node11 = __commonJS({
         getSecretForAuthenticatedUser: ["GET /user/codespaces/secrets/{secret_name}"],
         listDevcontainersInRepositoryForAuthenticatedUser: ["GET /repos/{owner}/{repo}/codespaces/devcontainers"],
         listForAuthenticatedUser: ["GET /user/codespaces"],
-        listInOrganization: ["GET /orgs/{org_id}/codespaces"],
+        listInOrganization: ["GET /orgs/{org}/codespaces", {}, {
+          renamedParameters: {
+            org_id: "org"
+          }
+        }],
         listInRepositoryForAuthenticatedUser: ["GET /repos/{owner}/{repo}/codespaces"],
         listRepoSecrets: ["GET /repos/{owner}/{repo}/codespaces/secrets"],
         listRepositoriesForSecretForAuthenticatedUser: ["GET /user/codespaces/secrets/{secret_name}/repositories"],
@@ -8729,7 +8732,7 @@ var require_dist_node11 = __commonJS({
         updateAuthenticated: ["PATCH /user"]
       }
     };
-    var VERSION = "5.16.0";
+    var VERSION = "5.16.2";
     function endpointsToMethods(octokit, endpointsMap) {
       const newMethods = {};
       for (const [scope, endpoints] of Object.entries(endpointsMap)) {
@@ -8826,7 +8829,7 @@ var require_dist_node12 = __commonJS({
 
 // src/lambdas/setup/index.ts
 var crypto = __toESM(require("crypto"));
-var querystring = __toESM(require("querystring"));
+var fs = __toESM(require("fs"));
 var import_rest = __toESM(require_dist_node12());
 
 // src/lambdas/helpers.ts
@@ -8861,152 +8864,46 @@ function baseUrlFromDomain(domain) {
 }
 
 // src/lambdas/setup/index.ts
-function getHtml(manifest, token, domain) {
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="utf-8"/>
-    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"/>
-    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
-    <title>Setup GitHub Runners</title>
-<body>
-<h1>Setup GitHub Runners</h1>
-<p>You can choose between creating a new app that will provide authentication for specific repositories, or a personal access token that will provide access to all repositories available to you. Apps are easier to set up and provide more fine-grained access control.</p>
-<form action="domain?token=${token}" method="post">
-    <fieldset>
-        <legend>GitHub Domain</legend>
-        <p>When using a GitHub Enterprise Server, change this to your own domain like github.mycompany.com.</p>
-        <label for="domain">Domain: </label>
-        <input id="domain" name="domain" value="${domain}">
-        <input type="submit" value="Update">
-    </fieldset>
-</form>
-
-<h2>Using App</h2>
-<p>Choose whether you want a personal app, an organization app, or an existing app created according to the instructions in <a href="https://github.com/CloudSnorkel/cdk-github-runners/blob/main/SETUP_GITHUB.md">SETUP_GITHUB.md</a>. The scope of the app should match the scope of the repositories you need to provide runners for.</p>
-<form action="https://${domain}/settings/apps/new?state=${token}" method="post" id="appform">
-    <fieldset>
-        <legend>New Personal App</legend>
-        <input type="hidden" name="manifest" id="manifest">
-        <input type="submit" value="Create">
-    </fieldset>
-</form>
-
-<br>
-<form action="https://${domain}/organizations/ORGANIZATION/settings/apps/new?state=${token}" method="post" id="orgappform">
-    <fieldset>
-        <legend>New Organization App</legend>
-        <label for="org">Organization slug:</label>
-        <input id="org" name="org" value="ORGANIZATION"><br><br>
-        <input type="hidden" name="manifest" id="manifestorg">
-        <input type="submit" value="Create">
-    </fieldset>
-</form>
-
-<br>
-<form action="app?token=${token}" method="post">
-    <fieldset>
-        <p>Existing apps must have <code>actions</code> and <code>administration</code> write permissions. Don't forget to set up the webhook and its secret as described in <a href="https://github.com/CloudSnorkel/cdk-github-runners/blob/main/SETUP_GITHUB.md">SETUP_GITHUB.md</a>.</p>
-        <legend>Existing App</legend>
-        <input type="hidden" name="domain" id="existingdomain" value="${domain}">
-        <label for="appid">App id:</label>
-        <input type="number" id="appid" name="appid"><br><br>
-        <label for="pk">Private key:</label>
-        <textarea id="pk" name="pk"></textarea><br><br>
-        <input type="submit" value="Set">
-    </fieldset>
-</form>
-
-<h2>Using Personal Access Token</h2>
-<p>The personal token must have the <code>repo</code> scope enable. Don't forget to also create a webhook as described in <a href="https://github.com/CloudSnorkel/cdk-github-runners/blob/main/SETUP_GITHUB.md">SETUP_GITHUB.md</a>.</p>
-<form action="pat?token=${token}" method="post">
-    <fieldset>
-        <label for="pat">Token:</label>
-        <input type="hidden" name="domain" id="patdomain" value="${domain}">
-        <input type="password" id="pat" name="pat">
-        <input type="submit" value="Set">
-    </fieldset>
-</form>
-
-<script>
-    document.getElementById("manifest").value = JSON.stringify(${manifest});
-    document.getElementById("manifestorg").value = JSON.stringify(${manifest});
-    function setDomainAndOrg() {
-        const domain = document.getElementById("domain").value;
-        const org = document.getElementById("org").value;
-        document.getElementById("appform").action = \`https://\${domain}/settings/apps/new?state=${token}\`;
-        document.getElementById("orgappform").action = \`https://\${domain}/organizations/\${org}/settings/apps/new?state=${token}\`;
-        document.getElementById("existingdomain").value = domain;
-        document.getElementById("patdomain").value = domain;
-    }
-    document.getElementById("domain").onchange = setDomainAndOrg;
-    document.getElementById("org").onchange = setDomainAndOrg;
-<\/script>
-</body>
-</html>
-`;
+var nonce = crypto.randomBytes(64).toString("hex");
+function getHtml(baseUrl, token, domain) {
+  return fs.readFileSync("index.html", "utf-8").replace(/INSERT_WEBHOOK_URL_HERE/g, process.env.WEBHOOK_URL).replace(/INSERT_BASE_URL_HERE/g, baseUrl).replace(/INSERT_TOKEN_HERE/g, token).replace(/INSERT_SECRET_ARN_HERE/g, process.env.SETUP_SECRET_ARN).replace(/INSERT_DOMAIN_HERE/g, domain).replace(/<script/g, `<script nonce="${nonce}"`).replace(/<style/g, `<style nonce="${nonce}"`);
 }
-function getManifest(baseUrl) {
-  return JSON.stringify({
-    url: "https://github.com/CloudSnorkel/cdk-github-runners",
-    hook_attributes: {
-      url: process.env.WEBHOOK_URL
-    },
-    redirect_url: `${baseUrl}/complete-new-app`,
-    public: false,
-    default_permissions: {
-      actions: "write",
-      administration: "write"
+function response(code, body) {
+  return {
+    statusCode: code,
+    headers: {
+      "Content-Type": "text/html",
+      "Content-Security-Policy": `default-src 'nonce-${nonce}'; img-src data:; connect-src 'self'; form-action https:; frame-ancestors 'none'`
     },
-    default_events: [
-      "workflow_job"
-    ]
-  });
+    body
+  };
 }
 async function handleRoot(event, setupToken) {
   const setupBaseUrl = `https://${event.requestContext.domainName}`;
   const githubSecrets = await getSecretJsonValue(process.env.GITHUB_SECRET_ARN);
-  return {
-    statusCode: 200,
-    headers: {
-      "Content-Type": "text/html"
-    },
-    body: getHtml(getManifest(setupBaseUrl), setupToken, githubSecrets.domain)
-  };
+  return response(200, getHtml(setupBaseUrl, setupToken, githubSecrets.domain));
 }
 function decodeBody(event) {
   let body = event.body;
   if (event.isBase64Encoded) {
     body = Buffer.from(body, "base64").toString("utf-8");
   }
-  return querystring.decode(body);
+  return JSON.parse(body);
 }
-async function handleDomain(event, setupToken) {
+async function handleDomain(event) {
   const body = decodeBody(event);
   if (!body.domain) {
-    return {
-      statusCode: 400,
-      headers: {
-        "Content-Type": "text/html"
-      },
-      body: "Invalid domain"
-    };
+    return response(400, "Invalid domain");
   }
   const githubSecrets = await getSecretJsonValue(process.env.GITHUB_SECRET_ARN);
   githubSecrets.domain = body.domain;
   await updateSecretValue(process.env.GITHUB_SECRET_ARN, JSON.stringify(githubSecrets));
-  return handleRoot(event, setupToken);
+  return response(200, "Domain set");
 }
 async function handlePat(event) {
   const body = decodeBody(event);
   if (!body.pat || !body.domain) {
-    return {
-      statusCode: 400,
-      headers: {
-        "Content-Type": "text/html"
-      },
-      body: "Invalid personal access token"
-    };
+    return response(400, "Invalid personal access token");
   }
   await updateSecretValue(process.env.GITHUB_SECRET_ARN, JSON.stringify({
     domain: body.domain,
@@ -9014,24 +8911,12 @@ async function handlePat(event) {
     personalAuthToken: body.pat
   }));
   await updateSecretValue(process.env.SETUP_SECRET_ARN, JSON.stringify({ token: "" }));
-  return {
-    statusCode: 200,
-    headers: {
-      "Content-Type": "text/html"
-    },
-    body: "Personal access token set"
-  };
+  return response(200, "Personal access token set");
 }
 async function handleNewApp(event) {
   const code = event.queryStringParameters.code;
   if (!code) {
-    return {
-      statusCode: 400,
-      headers: {
-        "Content-Type": "text/html"
-      },
-      body: "Invalid code"
-    };
+    return response(400, "Invalid code");
   }
   const githubSecrets = await getSecretJsonValue(process.env.GITHUB_SECRET_ARN);
   const baseUrl = baseUrlFromDomain(githubSecrets.domain);
@@ -9046,24 +8931,12 @@ async function handleNewApp(event) {
     webhookSecret: newApp.data.webhook_secret
   }));
   await updateSecretValue(process.env.SETUP_SECRET_ARN, JSON.stringify({ token: "" }));
-  return {
-    statusCode: 200,
-    headers: {
-      "Content-Type": "text/html"
-    },
-    body: `New app set. <a href="${newApp.data.html_url}/installations/new">Install it</a> for your repositories.`
-  };
+  return response(200, `New app set. <a href="${newApp.data.html_url}/installations/new">Install it</a> for your repositories.`);
 }
 async function handleExistingApp(event) {
   const body = decodeBody(event);
   if (!body.appid || !body.pk || !body.domain) {
-    return {
-      statusCode: 400,
-      headers: {
-        "Content-Type": "text/html"
-      },
-      body: "Missing fields"
-    };
+    return response(400, "Missing fields");
   }
   await updateSecretValue(process.env.GITHUB_SECRET_ARN, JSON.stringify({
     domain: body.domain,
@@ -9072,13 +8945,7 @@ async function handleExistingApp(event) {
   }));
   await updateSecretValue(process.env.GITHUB_PRIVATE_KEY_SECRET_ARN, body.pk);
   await updateSecretValue(process.env.SETUP_SECRET_ARN, JSON.stringify({ token: "" }));
-  return {
-    statusCode: 200,
-    headers: {
-      "Content-Type": "text/html"
-    },
-    body: "Existing app set. Don't forget to set up the webhook."
-  };
+  return response(200, "Existing app set. Don't forget to set up the webhook.");
 }
 exports.handler = async function(event) {
   if (!process.env.WEBHOOK_URL) {
@@ -9086,38 +8953,20 @@ exports.handler = async function(event) {
   }
   const setupToken = (await getSecretJsonValue(process.env.SETUP_SECRET_ARN)).token;
   if (!setupToken) {
-    return {
-      statusCode: 200,
-      headers: {
-        "Content-Type": "text/html"
-      },
-      body: "Setup already complete. Put a new token in the setup secret if you want to redo it."
-    };
+    return response(200, "Setup already complete. Put a new token in the setup secret if you want to redo it.");
   }
   if (!event.queryStringParameters) {
-    return {
-      statusCode: 403,
-      headers: {
-        "Content-Type": "text/html"
-      },
-      body: "Wrong setup token."
-    };
+    return response(403, "Wrong setup token.");
   }
-  const urlToken = event.queryStringParameters.token || event.queryStringParameters.state;
+  const urlToken = event.queryStringParameters.token || event.queryStringParameters.state || "";
   if (urlToken.length != setupToken.length || !crypto.timingSafeEqual(Buffer.from(urlToken, "utf-8"), Buffer.from(setupToken, "utf-8"))) {
-    return {
-      statusCode: 403,
-      headers: {
-        "Content-Type": "text/html"
-      },
-      body: "Wrong setup token."
-    };
+    return response(403, "Wrong setup token.");
   }
   try {
     if (event.requestContext.http.path == "/") {
       return await handleRoot(event, setupToken);
     } else if (event.requestContext.http.path == "/domain" && event.requestContext.http.method == "POST") {
-      return await handleDomain(event, setupToken);
+      return await handleDomain(event);
     } else if (event.requestContext.http.path == "/pat" && event.requestContext.http.method == "POST") {
       return await handlePat(event);
     } else if (event.requestContext.http.path == "/complete-new-app" && event.requestContext.http.method == "GET") {
@@ -9125,22 +8974,10 @@ exports.handler = async function(event) {
     } else if (event.requestContext.http.path == "/app" && event.requestContext.http.method == "POST") {
       return await handleExistingApp(event);
     } else {
-      return {
-        statusCode: 404,
-        headers: {
-          "Content-Type": "text/html"
-        },
-        body: "Not found"
-      };
+      return response(404, "Not found");
     }
   } catch (e) {
-    return {
-      statusCode: 500,
-      headers: {
-        "Content-Type": "text/html"
-      },
-      body: `<b>Error:</b> ${e}`
-    };
+    return response(500, `<b>Error:</b> ${e}`);
   }
 };
 /*!