log GitHub Actions runtime token access controls

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

src/github.ts

@@ -0,0 +1,9 @@
+import jwt_decode, {JwtPayload} from 'jwt-decode';
+
+interface Jwt extends JwtPayload {
+  ac?: string;
+}
+
+export const parseRuntimeToken = (token: string): Jwt => {
+  return jwt_decode<Jwt>(token);
+};

src/main.ts

@@ -2,6 +2,7 @@ import * as fs from 'fs';
 import * as buildx from './buildx';
 import * as context from './context';
 import * as docker from './docker';
+import * as github from './github';
 import * as stateHelper from './state-helper';
 import * as core from '@actions/core';
 import * as exec from '@actions/exec';
@@ -14,6 +15,15 @@ async function run(): Promise<void> {
     // standalone if docker cli not available
     const standalone = !(await docker.isAvailable());
 
+    await core.group(`GitHub Actions runtime token access controls`, async () => {
+      const actionsRuntimeToken = process.env['ACTIONS_RUNTIME_TOKEN'];
+      if (actionsRuntimeToken) {
+        core.info(JSON.stringify(JSON.parse(github.parseRuntimeToken(actionsRuntimeToken).ac as string), undefined, 2));
+      } else {
+        core.info(`ACTIONS_RUNTIME_TOKEN not set`);
+      }
+    });
+
     core.startGroup(`Docker info`);
     if (standalone) {
       core.info(`Docker info skipped in standalone mode`);