@theappagency/valinor 10.22.0 → 10.24.0

package/README.md

@@ -29,6 +29,17 @@ Actions and allow-listed networks. An HTTP 401 or 403 is never retried; the erro
 `pull_request` run from a fork cannot mint an OIDC token, so it needs `VALINOR_DOWNLOADS_TOKEN` once the
 endpoint requires authentication.
 
+**Dependabot and fork runs.** Every bundle-fetching step Valinor renders passes
+`VALINOR_DOWNLOADS_TOKEN: ${{ secrets.VALINOR_DOWNLOADS_TOKEN }}` in its own `env:` (never the job's, where a
+Dependabot pull request's install scripts would see it), so a run that cannot mint still authenticates. Only the
+download reads it: the rendered step unsets it once the download has its credential, and the launcher runs the CLI
+without it, so nothing the CLI runs can read it. A
+Dependabot run reads Dependabot secrets, not Actions secrets: add `VALINOR_DOWNLOADS_TOKEN` under Settings >
+Secrets and variables > Dependabot. When a run with no credential is refused, the error says it is a Dependabot
+run or a fork pull request and names that secret. A fork pull request gets no secrets at all, so it fails closed
+rather than skip the check. The rendered verify step stops on a 401 or 403 instead of falling back to `npx`, which
+would ask the same endpoint and be refused the same way; an endpoint it cannot reach still falls back.
+
 **Getting a downloads token.** Ask whoever runs your Valinor downloads endpoint for a personal token: each
 person gets their own, so one person's access can be withdrawn without touching anyone else's. Keep it in
 your secret store and export it as `VALINOR_DOWNLOADS_TOKEN` in the shell that runs Valinor; never commit

package/lib/launcher.js

@@ -253,8 +253,36 @@ async function readBodyPrefix(res, max = REFUSAL_BODY_PREFIX_BYTES) {
   return new TextDecoder().decode(Buffer.concat(chunks).subarray(0, max));
 }
 
+/**
+ * Which secretless GitHub Actions run this is, or null: `dependabot` (the actor is Dependabot, whose runs read
+ * Dependabot secrets, not Actions secrets) or `fork` (a pull_request event whose head repository is not this one,
+ * which GitHub gives no repository secrets). Read from the runner's own variables and event file; a file it cannot
+ * read is not a fork.
+ */
+export function secretlessRun(env = process.env) {
+  if (env.GITHUB_ACTOR === "dependabot[bot]") return "dependabot";
+  if (env.GITHUB_EVENT_NAME !== "pull_request" || !env.GITHUB_EVENT_PATH || !env.GITHUB_REPOSITORY) return null;
+  try {
+    const head = JSON.parse(readFileSync(env.GITHUB_EVENT_PATH, "utf8"))?.pull_request?.head?.repo?.full_name;
+    return typeof head === "string" && head !== "" && head.toLowerCase() !== env.GITHUB_REPOSITORY.toLowerCase() ? "fork" : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Said after a refusal of a request that carried no credential, on a run {@link secretlessRun} names. */
+const SECRETLESS_RUN_FIX = {
+  dependabot:
+    "This is a Dependabot run: it reads Dependabot secrets, not Actions secrets. Add VALINOR_DOWNLOADS_TOKEN as a Dependabot secret " +
+    "(Settings > Secrets and variables > Dependabot); Valinor's rendered steps pass it to the download.",
+  fork:
+    "This is a pull request from a fork: GitHub gives it no OIDC token and no Actions secrets, so it cannot download Valinor and fails here " +
+    "rather than skip the check. A Dependabot pull request needs VALINOR_DOWNLOADS_TOKEN as a Dependabot secret; a contributor's fork " +
+    "pull request passes once its branch runs from this repository.",
+};
+
 /** The refusal for a 401/403 — an auth answer is never an outage, so it names the fix, not the network. */
-function authRefusal(url, status, sentCredential, headers, body) {
+function authRefusal(url, status, sentCredential, headers, body, secretless = null) {
   const fix =
     "In GitHub Actions, add `permissions: id-token: write` to this job so the launcher can mint an OIDC token " +
     "(`valinor refresh-workflows --apply` adds it to Valinor's own workflows); elsewhere, set VALINOR_DOWNLOADS_TOKEN.";
@@ -283,6 +311,7 @@ function authRefusal(url, status, sentCredential, headers, body) {
       ? `${url} returned HTTP 401: the downloads endpoint refused the credential the launcher sent (expired or not valid for it). ${fix}`
       : `${url} returned HTTP 401: the downloads endpoint requires authentication and this run sent no credential. ${fix}`;
   }
+  if (!sentCredential && secretless) message = `${message} ${SECRETLESS_RUN_FIX[secretless]}`;
   const e = fetchError(`${message}\n${HARD_STOP}`, false);
   e.auth = true;
   return e;
@@ -329,6 +358,8 @@ export function fetchPolicy(env = process.env) {
     attempts: positiveInteger(env.VALINOR_FETCH_ATTEMPTS, 3),
     backoffMs: positiveNumber(env.VALINOR_FETCH_BACKOFF_MS, 1_000),
     totalTimeoutMs: positiveNumber(env.VALINOR_FETCH_TOTAL_TIMEOUT_MS, 120_000),
+    // Not a timing: which secretless run this is, so a refusal names the secret that run can read (authRefusal).
+    secretless: secretlessRun(env),
   };
 }
 
@@ -387,7 +418,7 @@ async function fetchBody(url, read, fetchImpl, policy, cancel, authorization) {
       // A 403's body says WHO refused (the Worker's one-line answer, or a block page's title), so a bounded prefix of
       // it is read, unless a `cf-mitigated` header already says so; every other body is cancelled unread.
       const body = res.status === 403 && !res.headers.get("cf-mitigated") ? await readBodyPrefix(res) : "";
-      last = authRefusal(url, res.status, credential !== null, res.headers, body);
+      last = authRefusal(url, res.status, credential !== null, res.headers, body, policy.secretless ?? null);
       await res.body?.cancel().catch(() => {});
     } else if (res && !res.ok) {
       last = fetchError(`${url} returned HTTP ${res.status}`, isTransientStatus(res.status));
@@ -571,8 +602,19 @@ export function cachedBinPath(versionDir) {
 }
 
 /** Spawn the cached CLI with argv passed through; returns its exit code (stdio inherited). */
+/**
+ * The environment the CLI runs with: this process's, minus VALINOR_DOWNLOADS_TOKEN. The token is the download's
+ * credential, and the download is done; the CLI and everything it runs (a scanner from `node_modules/.bin`, which a pull
+ * request's install script could have replaced) never see it.
+ */
+export function cliChildEnv(env = process.env) {
+  const rest = { ...env };
+  delete rest.VALINOR_DOWNLOADS_TOKEN;
+  return rest;
+}
+
 export function spawnCli(binPath, args) {
-  const result = spawnSync(process.execPath, [binPath, ...args], { stdio: "inherit" });
+  const result = spawnSync(process.execPath, [binPath, ...args], { stdio: "inherit", env: cliChildEnv() });
   if (result.error) throw result.error;
   if (result.signal) {
     process.kill(process.pid, result.signal); // propagate the signal-death faithfully (Ctrl-C etc.).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theappagency/valinor",
-  "version": "10.22.0",
+  "version": "10.24.0",
   "description": "Public launcher for the Valinor CLI — fetches, SHA-256-verifies, caches, and runs the proprietary Valinor bundle from downloads.valinorci.com. Zero setup, zero secrets, zero npm auth.",
   "repository": {
     "type": "git",