fix: pass github-token input to APM subprocess as GITHUB_TOKEN

[danielmeppiel]

Problem

The action declares a github-token input (defaults to ${{ github.token }}) but never reads it or exports it to the subprocess environment. GitHub Actions does not auto-export input values as environment variables, so APM runs unauthenticated.

Impact:

• Private repo dependencies fail silently (no GITHUB_TOKEN in subprocess)
• GitHub API rate limits hit the unauthenticated ceiling (60 req/hr vs 5,000/hr)
• Users who set github-token expect it to work — it doesn't

Found during microsoft/apm#356 which fixed APM itself to be resilient to missing tokens, but noted this action-side bug needed a separate fix.

Fix

Read the github-token input with core.getInput(), mask it with core.setSecret(), and set process.env.GITHUB_TOKEN before any APM subprocess calls. Since runApm() passes { ...process.env } to child processes, the token propagates automatically.

const githubToken = core.getInput('github-token');
if (githubToken) {
  core.setSecret(githubToken);
  process.env.GITHUB_TOKEN = githubToken;
}

Tests

• passes github-token input as GITHUB_TOKEN env var — verifies token is set in env and masked
• does not set GITHUB_TOKEN when github-token input is empty — verifies no-op when empty

All 44 tests pass.

[Copilot]

Pull request overview

Fixes the action’s github-token input not being propagated to APM subprocesses by exporting it as GITHUB_TOKEN (and masking it) before any APM CLI invocations, ensuring authenticated GitHub API/dependency access.

Changes:

• Read github-token, mask it via core.setSecret(), and set process.env.GITHUB_TOKEN for subprocess inheritance.
• Add unit tests validating GITHUB_TOKEN propagation and no-op behavior when the input is empty.
• Regenerate dist/index.js to include the runtime changes.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/runner.ts	Exports github-token input to process.env.GITHUB_TOKEN and masks it before running APM.
src/__tests__/runner.test.ts	Adds coverage for token propagation/masking and empty-input behavior.
dist/index.js	Updates bundled output to reflect the source changes (ncc build artifact).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[danielmeppiel]

Good catch — fixed in #16. Changed = to ??= so an existing GITHUB_TOKEN (e.g., a PAT from job-level env:) is preserved. Added a test for the non-clobber case.