dependency-change-report 1.3.3 → 1.4.0

package/README.md

@@ -139,9 +139,13 @@ on:
 jobs:
   dependency-report:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
     steps:
       - uses: actions/checkout@v4
         with:
+          token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0  # Need full history for version detection
       
       - uses: actions/setup-node@v4
@@ -150,6 +154,8 @@ jobs:
       
       - name: Generate dependency report
         run: npx dependency-change-report auto --output-dir ./reports
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       
       - name: Upload reports as artifacts
         uses: actions/upload-artifact@v4
@@ -175,9 +181,11 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      actions: read
     steps:
       - uses: actions/checkout@v4
         with:
+          token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0
       
       - uses: actions/setup-node@v4
@@ -187,6 +195,8 @@ jobs:
       - name: Generate dependency report
         id: dep-report
         run: npx dependency-change-report auto --output-dir ./reports
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       
       - name: Upload reports as artifacts
         uses: actions/upload-artifact@v4
@@ -219,8 +229,38 @@ To compare specific commits or tags instead of auto-detection:
 ```yaml
       - name: Generate dependency report
         run: npx dependency-change-report compare https://github.com/${{ github.repository }} ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }} --output-dir ./reports
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 ```
 
+### Private Repository Support
+
+For private repositories, the tool automatically detects GitHub Actions environment and configures Git authentication using the provided `GITHUB_TOKEN`. Make sure to:
+
+1. **Include the token in your workflow step**:
+   ```yaml
+   env:
+     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+   ```
+
+2. **Set appropriate permissions** in your workflow:
+   ```yaml
+   permissions:
+     contents: read
+     actions: read
+     pull-requests: write  # Only needed for PR comments
+   ```
+
+3. **Use the token in checkout** for private repositories:
+   ```yaml
+   - uses: actions/checkout@v4
+     with:
+       token: ${{ secrets.GITHUB_TOKEN }}
+       fetch-depth: 0
+   ```
+
+The tool will automatically configure Git to use the token for authentication when accessing private repositories.
+
 ### Available Outputs
 
 When running in GitHub Actions, the tool provides these outputs that can be used in subsequent steps:

package/cli.mjs

@@ -42,9 +42,16 @@ const compare = command(
         const token = process.env.GITHUB_TOKEN;
         if (token) {
           console.log(`Original repo URL: ${repoUrl}`);
-          // Convert https://github.com/owner/repo to https://token:x-oauth-basic@github.com/owner/repo
-          repoUrl = repoUrl.replace('https://github.com/', `https://${token}:x-oauth-basic@github.com/`);
-          console.log('Modified repo URL to use GitHub token authentication');
+          try {
+            // Configure git to use the token for GitHub authentication
+            await executeCommand('git', ['config', '--global', 'url.https://github.com/.insteadOf', 'git@github.com:'], process.cwd(), 10000);
+            await executeCommand('git', ['config', '--global', `url.https://${token}:x-oauth-basic@github.com/.insteadOf`, 'https://github.com/'], process.cwd(), 10000);
+            console.log('Configured Git to use GitHub token authentication');
+          } catch (error) {
+            console.log('Failed to configure Git authentication, falling back to URL modification');
+            // Fallback to URL modification
+            repoUrl = repoUrl.replace('https://github.com/', `https://${token}:x-oauth-basic@github.com/`);
+          }
           console.log('Using GitHub token for private repository access');
         } else {
           console.log('GitHub Actions detected but no GITHUB_TOKEN found');
@@ -207,9 +214,16 @@ const auto = command(
         const token = process.env.GITHUB_TOKEN;
         if (token) {
           console.log(`Original repo URL: ${repoUrl}`);
-          // Convert https://github.com/owner/repo to https://token:x-oauth-basic@github.com/owner/repo
-          repoUrl = repoUrl.replace('https://github.com/', `https://${token}:x-oauth-basic@github.com/`);
-          console.log('Modified repo URL to use GitHub token authentication');
+          try {
+            // Configure git to use the token for GitHub authentication
+            await executeCommand('git', ['config', '--global', 'url.https://github.com/.insteadOf', 'git@github.com:'], process.cwd(), 10000);
+            await executeCommand('git', ['config', '--global', `url.https://${token}:x-oauth-basic@github.com/.insteadOf`, 'https://github.com/'], process.cwd(), 10000);
+            console.log('Configured Git to use GitHub token authentication');
+          } catch (error) {
+            console.log('Failed to configure Git authentication, falling back to URL modification');
+            // Fallback to URL modification
+            repoUrl = repoUrl.replace('https://github.com/', `https://${token}:x-oauth-basic@github.com/`);
+          }
           console.log('Using GitHub token for private repository access');
         } else {
           console.log('GitHub Actions detected but no GITHUB_TOKEN found');

package/lib/git/repository.mjs

@@ -14,16 +14,26 @@ import { registerTempDir, unregisterTempDir } from '../utils/cleanup-manager.mjs
 export const cloneRepo = async (repoUrl, ref, targetDir, enablePeriodicLogging = false) => {
   const repoName = basename(repoUrl, '.git');
   
+  // Apply GitHub token authentication if in GitHub Actions
+  let authenticatedRepoUrl = repoUrl;
+  const isGitHubActions = process.env.GITHUB_ACTIONS === 'true';
+  if (isGitHubActions && repoUrl.includes('github.com')) {
+    const token = process.env.GITHUB_TOKEN;
+    if (token) {
+      authenticatedRepoUrl = repoUrl.replace('https://github.com/', `https://${token}:x-oauth-basic@github.com/`);
+    }
+  }
+  
   try {
     // Use shallow clone with depth=1 and single-branch for faster cloning
     // Use --quiet to avoid printing credentials in logs
     // 2 minute timeout for very large repositories
-    await executeCommand('git', ['clone', '--quiet', '--depth=1', '--single-branch', '--branch', ref, repoUrl, targetDir], undefined, time_2min, `git clone of ${repoName} (${ref})`, enablePeriodicLogging);
+    await executeCommand('git', ['clone', '--quiet', '--depth=1', '--single-branch', '--branch', ref, authenticatedRepoUrl, targetDir], undefined, time_2min, `git clone of ${repoName} (${ref})`, enablePeriodicLogging);
   } catch (error) {
     // If shallow clone with specific branch fails, try traditional approach
     try {
       // Full clone with 5 minute timeout for very large repos
-      await executeCommand('git', ['clone', '--quiet', repoUrl, targetDir], undefined, time_5min, `git clone of ${repoName} (full)`, enablePeriodicLogging);
+      await executeCommand('git', ['clone', '--quiet', authenticatedRepoUrl, targetDir], undefined, time_5min, `git clone of ${repoName} (full)`, enablePeriodicLogging);
       await executeCommand('git', ['checkout', ref], targetDir, time_1min, `git checkout ${ref}`, enablePeriodicLogging);
     } catch (fallbackError) {
       throw fallbackError;
@@ -51,12 +61,22 @@ export const getCommitHistory = async (repoUrl, oldVersion, newVersion, reposDir
     // Register this temp directory for cleanup
     registerTempDir(tempDir);
     
+    // Apply GitHub token authentication if in GitHub Actions
+    let authenticatedRepoUrl = repoUrl;
+    const isGitHubActions = process.env.GITHUB_ACTIONS === 'true';
+    if (isGitHubActions && repoUrl.includes('github.com')) {
+      const token = process.env.GITHUB_TOKEN;
+      if (token) {
+        authenticatedRepoUrl = repoUrl.replace('https://github.com/', `https://${token}:x-oauth-basic@github.com/`);
+      }
+    }
+    
     // Clone the repository with optimizations for faster cloning
     // Use --quiet to avoid printing credentials in logs
     // Use --depth=1 and --single-branch for faster cloning, then fetch what we need
     try {
       // 2 minute timeout for very large repositories
-      await executeCommand('git', ['clone', '--quiet', '--depth=1', '--single-branch', repoUrl, tempDir], undefined, time_2min, `git clone of ${packageName} for history`, false);
+      await executeCommand('git', ['clone', '--quiet', '--depth=1', '--single-branch', authenticatedRepoUrl, tempDir], undefined, time_2min, `git clone of ${packageName} for history`, false);
     } catch (error) {
       // If the repository doesn't exist or can't be accessed, throw a more specific error
       if (error.message.includes("Repository not found") || 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dependency-change-report",
-  "version": "1.3.3",
+  "version": "1.4.0",
   "type": "module",
   "description": "Generate dependency change reports between git references",
   "main": "lib/index.mjs",