Add option to not revoke token (#95)

Author: tibdex

README.md

@@ -43,6 +43,9 @@ jobs:
           # repositories: >-
           #   ["actions/toolkit", "github/docs"]
 
+          # Optional.
+          # revoke: false
+
       - run: "echo 'The created token is masked: ${{ steps.create_token.outputs.token }}'"
 ```
 

action.yml

@@ -41,6 +41,9 @@ inputs:
       The JSON-stringified array of the full names of the repositories the token should have access to.
       Defaults to all repositories that the installation can access.
       See https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#create-an-installation-access-token-for-an-app's `repositories`.
+  revoke:
+    description: Revoke the token at the end of the job.
+    default: true
 outputs:
   token:
     description: An installation access token for the GitHub App.

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "github-app-token",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "license": "MIT",
   "type": "module",
   "files": [
@@ -16,7 +16,7 @@
     "typecheck": "tsc --build"
   },
   "dependencies": {
-    "@actions/core": "^1.10.0",
+    "@actions/core": "^1.10.1",
     "@actions/github": "^5.1.1",
     "@octokit/auth-app": "^6.0.0",
     "@octokit/request": "^8.1.1",
@@ -25,7 +25,7 @@
   "devDependencies": {
     "@trivago/prettier-plugin-sort-imports": "^4.2.0",
     "@types/is-base64": "^1.1.1",
-    "@types/node": "^20.6.0",
+    "@types/node": "^20.6.2",
     "@vercel/ncc": "^0.38.0",
     "prettier": "^3.0.3",
     "prettier-plugin-packagejson": "^2.4.5",

package.json

@@ -1,10 +1,15 @@
-import { getState, info } from "@actions/core";
+import { getInput, getState, info } from "@actions/core";
 
 import { revokeInstallationAccessToken } from "./revoke-installation-access-token.js";
 import { run } from "./run.js";
 import { tokenKey } from "./state.js";
 
 await run(async () => {
+  if (!JSON.parse(getInput("revoke"))) {
+    info("Token revocation skipped");
+    return;
+  }
+
   const token = getState(tokenKey);
   if (!token) {
     info("No token to revoke");