Something seems to have broken with omitting tokens

[MattiDragon]

I'm using this action, wrapped in a custom workflow that does other things. I recently updated my version from v3.2 to v3.3.0 and something seems to have broken with the handling of missing tokens. One my projects isn't published on curseforge, so I don't provide a token or project it in its workflow. This used to work, but now I'm getting an error that the curseforge project doesn't exist. This shouldn't happen as no token is provided, unless mc-publish decided to pick up the unused CURSEFORGE_TOKEN actions secret without me giving it as input (the token is there because I sync my tokens to all mods that need any of them). I'm just confused as to where mc-publish is getting something it thinks is a curseforge token (it should ignore empty strings, right?)

[MattiDragon]

I just ran a run with the actions debug on, and it might be that the curseforge token ends up being "null", but I don't see it being passed into the action, so I would expect it to be correct

[Kir-Antipov]

I don't see it being passed into the action, so I would expect it to be correct

Sadly, there's no such thing as an input not being passed to the action. GitHub always passes some value to every input of the action. If you haven't specified any - too bad, because some Microsoft genius decided that null and undefined, both describing an "unset" value in terms of JS, are not enough - to represent a missing value, GitHub Actions use an empty string, making it impossible to distinguish between an omitted input and an explicitly provided empty string.

You may not see it, because, unlike actions, GitHub itself, as the provider of these values, can distinguish between specified and unspecified inputs. Hence, it doesn't render an empty string it provided to the action, thereby just worsening the confusion for both developers and users of those actions.

However, the ability to recognize when a user hasn't specify an input is crucial for many actions, including this one. So, lots of developers, like myself, employ a "trick" of defining our own special constants that we can treat as undefined. As you could probably notice, logs of mc-publish invocations are filled with lines like this one:

changelog-file: ${undefined}

This is because "${undefined}" is a special string value, set as the default for every input of the action. Therefore, when you omit an input, GitHub automatically supplies it instead of an empty string. And I can finally distinguish empty strings from entirely omitted inputs.

Part of the problem in your case stems from the fact that you do specify the curseforge-token input. Consequently, it is once again subject to the "treat null and undefined values as empty strings" nonsense from Microsoft.

it should ignore empty strings, right?

And here goes the second part of the issue. Previously, I explicitly filtered out any falsy token values:

mc-publish/src/program.ts

Lines 68 to 70 in c0f30ad

	if (!platformOptions?.token) {
	continue;
	}

This part of the code has not changed. However, token is no longer a string, it's now an object of type SecureString, designed to minimize the risk of accidental exposure of your precious tokens. And... let's just say that I may or may not have forgotten to move the filtering logic to the method responsible for creating SecureStrings. As a result, it currently wraps empty strings just like any other string.

This is a regression on my side. I apologize for that and I will definitely fix the issue. Meanwhile, you could replace:

curseforge-token: ${{ secrets.curseforge-token }}

with:

curseforge-token: ${{ secrets.curseforge-token || '${undefined}' }}

And you should be golden!

Thank you for your understanding.

[MattiDragon]

Thanks for the answer, I'll update my workflow