Allow obliterating id token privs

src/index.ts

@@ -8,7 +8,7 @@ import { collectBacktraces } from "./backtrace.js";
 import { CheckIn, Feature } from "./check-in.js";
 import * as correlation from "./correlation.js";
 import { IdsHost } from "./ids-host.js";
-import { getBool, getStringOrNull } from "./inputs.js";
+import { getBool, getBoolOrUndefined, getStringOrNull } from "./inputs.js";
 import * as platform from "./platform.js";
 import { SourceDef, constructSourceParameters } from "./sourcedef.js";
 import * as actionsCache from "@actions/cache";
@@ -200,6 +200,15 @@ export abstract class DetSysAction {
     this.nixStoreTrust = "unknown";
     this.strictMode = getBool("_internal-strict-mode");
 
+    if (
+      getBoolOrUndefined(
+        "_internal-obliterate-actions-id-token-request-variables",
+      ) === true
+    ) {
+      process.env["ACTIONS_ID_TOKEN_REQUEST_URL"] = undefined;
+      process.env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"] = undefined;
+    }
+
     this.features = {};
     this.featureEventMetadata = {};
     this.events = [];

src/inputs.ts

@@ -11,6 +11,17 @@ const getBool = (name: string): boolean => {
   return actionsCore.getBooleanInput(name);
 };
 
+/**
+ * Get a Boolean input from the Action's configuration by name, or undefined if it is unset.
+ */
+const getBoolOrUndefined = (name: string): boolean | undefined => {
+  if (getStringOrUndefined(name) === undefined) {
+    return undefined;
+  }
+
+  return actionsCore.getBooleanInput(name);
+};
+
 /**
  * The character used to separate values in the input string.
  */
@@ -108,6 +119,7 @@ const getStringOrUndefined = (name: string): string | undefined => {
 
 export {
   getBool,
+  getBoolOrUndefined,
   getArrayOfStrings,
   getArrayOfStringsOrNull,
   getMultilineStringOrNull,