dependency-change-report 1.3.2 → 1.3.4

package/README.md

@@ -139,9 +139,13 @@ on:
 jobs:
   dependency-report:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
     steps:
       - uses: actions/checkout@v4
         with:
+          token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0  # Need full history for version detection
       
       - uses: actions/setup-node@v4
@@ -150,6 +154,8 @@ jobs:
       
       - name: Generate dependency report
         run: npx dependency-change-report auto --output-dir ./reports
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       
       - name: Upload reports as artifacts
         uses: actions/upload-artifact@v4
@@ -175,9 +181,11 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      actions: read
     steps:
       - uses: actions/checkout@v4
         with:
+          token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0
       
       - uses: actions/setup-node@v4
@@ -187,6 +195,8 @@ jobs:
       - name: Generate dependency report
         id: dep-report
         run: npx dependency-change-report auto --output-dir ./reports
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       
       - name: Upload reports as artifacts
         uses: actions/upload-artifact@v4
@@ -219,8 +229,38 @@ To compare specific commits or tags instead of auto-detection:
 ```yaml
       - name: Generate dependency report
         run: npx dependency-change-report compare https://github.com/${{ github.repository }} ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }} --output-dir ./reports
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 ```
 
+### Private Repository Support
+
+For private repositories, the tool automatically detects GitHub Actions environment and configures Git authentication using the provided `GITHUB_TOKEN`. Make sure to:
+
+1. **Include the token in your workflow step**:
+   ```yaml
+   env:
+     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+   ```
+
+2. **Set appropriate permissions** in your workflow:
+   ```yaml
+   permissions:
+     contents: read
+     actions: read
+     pull-requests: write  # Only needed for PR comments
+   ```
+
+3. **Use the token in checkout** for private repositories:
+   ```yaml
+   - uses: actions/checkout@v4
+     with:
+       token: ${{ secrets.GITHUB_TOKEN }}
+       fetch-depth: 0
+   ```
+
+The tool will automatically configure Git to use the token for authentication when accessing private repositories.
+
 ### Available Outputs
 
 When running in GitHub Actions, the tool provides these outputs that can be used in subsequent steps:

package/cli.mjs

@@ -42,9 +42,16 @@ const compare = command(
         const token = process.env.GITHUB_TOKEN;
         if (token) {
           console.log(`Original repo URL: ${repoUrl}`);
-          // Convert https://github.com/owner/repo to https://token@github.com/owner/repo
-          repoUrl = repoUrl.replace('https://github.com/', `https://${token}@github.com/`);
-          console.log('Modified repo URL to use GitHub token authentication');
+          try {
+            // Configure git to use the token for GitHub authentication
+            await executeCommand('git', ['config', '--global', 'url.https://github.com/.insteadOf', 'git@github.com:'], process.cwd(), 10000);
+            await executeCommand('git', ['config', '--global', `url.https://${token}:x-oauth-basic@github.com/.insteadOf`, 'https://github.com/'], process.cwd(), 10000);
+            console.log('Configured Git to use GitHub token authentication');
+          } catch (error) {
+            console.log('Failed to configure Git authentication, falling back to URL modification');
+            // Fallback to URL modification
+            repoUrl = repoUrl.replace('https://github.com/', `https://${token}:x-oauth-basic@github.com/`);
+          }
           console.log('Using GitHub token for private repository access');
         } else {
           console.log('GitHub Actions detected but no GITHUB_TOKEN found');
@@ -207,9 +214,16 @@ const auto = command(
         const token = process.env.GITHUB_TOKEN;
         if (token) {
           console.log(`Original repo URL: ${repoUrl}`);
-          // Convert https://github.com/owner/repo to https://token@github.com/owner/repo
-          repoUrl = repoUrl.replace('https://github.com/', `https://${token}@github.com/`);
-          console.log('Modified repo URL to use GitHub token authentication');
+          try {
+            // Configure git to use the token for GitHub authentication
+            await executeCommand('git', ['config', '--global', 'url.https://github.com/.insteadOf', 'git@github.com:'], process.cwd(), 10000);
+            await executeCommand('git', ['config', '--global', `url.https://${token}:x-oauth-basic@github.com/.insteadOf`, 'https://github.com/'], process.cwd(), 10000);
+            console.log('Configured Git to use GitHub token authentication');
+          } catch (error) {
+            console.log('Failed to configure Git authentication, falling back to URL modification');
+            // Fallback to URL modification
+            repoUrl = repoUrl.replace('https://github.com/', `https://${token}:x-oauth-basic@github.com/`);
+          }
           console.log('Using GitHub token for private repository access');
         } else {
           console.log('GitHub Actions detected but no GITHUB_TOKEN found');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dependency-change-report",
-  "version": "1.3.2",
+  "version": "1.3.4",
   "type": "module",
   "description": "Generate dependency change reports between git references",
   "main": "lib/index.mjs",