fix: preserve caller's GITHUB_TOKEN when already set in environment

[danielmeppiel]

Problem

Follow-up to #15 — addresses the review comment:

Since github-token has a non-empty default (${{ github.token }}), the = assignment in #15 would overwrite a GITHUB_TOKEN already present in the environment. This clobbers a user's PAT when they set it via job-level env: rather than the action input.

Scenario:

env:
  GITHUB_TOKEN: ${{ secrets.MY_PAT }}  # user's PAT for private repos
steps:
  - uses: microsoft/apm-action@v1      # default github-token = github.token
    # ❌ v1.3.3: overwrites MY_PAT with the less-privileged github.token
    # ✅ this fix: preserves MY_PAT

Fix

One-character change: = → ??=

process.env.GITHUB_TOKEN ??= githubToken;

The nullish-coalescing assignment only sets the value when GITHUB_TOKEN is undefined or null, preserving any existing token.

Tests

New test: does not clobber existing GITHUB_TOKEN from job-level env — sets process.env.GITHUB_TOKEN to a PAT before run() and verifies it's preserved.

All 45 tests pass.

[Copilot]

Pull request overview

This PR adjusts how the action propagates the github-token input into the environment so it won’t overwrite a GITHUB_TOKEN already provided by the caller (e.g., via job-level env:), while keeping the token available to the APM subprocess.

Changes:

• Switch process.env.GITHUB_TOKEN assignment to nullish-coalescing assignment (??=) to avoid clobbering an existing env var.
• Add a unit test ensuring an existing GITHUB_TOKEN is preserved.
• Regenerate dist/index.js to match the source change.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
src/runner.ts	Preserve any pre-set GITHUB_TOKEN while still honoring the github-token input when GITHUB_TOKEN is unset.
src/__tests__/runner.test.ts	Adds coverage for the “do not clobber existing GITHUB_TOKEN” behavior.
dist/index.js	Built output updated to reflect the ??= change.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.