Add the ability to provide a separate auth token vs. patcher update token

[ceschae]

Description

Adds the ability to distinguish between the PAT used to download and run Gruntwork tools vs. the PAT used for patcher update, which includes write access to the customer repo.

Distinguishing the two PATs is a nice security feature, and allows for finer controls over access / better enforcement of the principle of least privilege

validation

• it works!
• it's also backwards compatible, works with just one token

[ZachGoldberg]

Suggested change

	var updateToken = core.getInput("update_token");
	const updateToken = core.getInput("update_token");

[ceschae]

it won't let me overwrite it later, if i keep it as a const. this was the simplest way imo to keep back compatibility, but i'm open to other ideas?

[ZachGoldberg]

The general pattern would be something like

const token1 = getToken1();
const token2 = getToken2();
const theTokenToUse = token1 ? token1 : token2;

someplace_later_that_needs_token(theTokenToUse)

[ZachGoldberg]

Also, if you truly do need the value to change, use let instead of var. In only very very rare circumstances is var more correct than let in modern JS.

[ceschae]

thank you for the knowledge! i am a "can get by OK" type/coffee/javascript programmer. always grateful for the inside scoop!

[ceschae]

TIL. in javascript, token1 ? token1 : token2 and token1 ?? token2 return different values if token1 is empty string as opposed to nullish. my favorite programming language! /s

[ceschae]

source for ternary: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Conditional_operator#description

source for nullish: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Nullish_coalescing#description

[ZachGoldberg]

nit: I might call this instead the "gruntwork token" or "gruntwork code access token"