Merge pull request #198 from DeterminateSystems/gustavderdrache/push-mzwwpswkrrup

Record events if authentication is skipped

Author: gustavderdrache

dist/index.js

@@ -26,6 +26,7 @@ const EVENT_UNINSTALL_NIX = "uninstall";
 
 // FlakeHub events
 const EVENT_LOGIN_TO_FLAKEHUB = "login_to_flakehub";
+const EVENT_LOGIN_FAILURE = "flakehub-login:failure";
 
 // Other events
 const EVENT_CONCLUDE_JOB = "conclude_job";
@@ -725,14 +726,17 @@ class NixInstallerAction extends DetSysAction {
       const head = pr?.head?.repo?.full_name;
 
       if (pr && base !== head) {
+        this.recordEvent(EVENT_LOGIN_FAILURE, { reason: "fork" });
         actionsCore.info(
-          `Not logging in to FlakeHub: GitHub Actions does not allow OIDC authentication from forked repositories ("${head}" is not the same repository as "${base}").`,
+          `FlakeHub is disabled because this is a fork. GitHub Actions does not allow OIDC authentication from forked repositories ("${head}" is not from the same repository as "${base}").`,
         );
         return;
       }
 
+      this.recordEvent(EVENT_LOGIN_FAILURE, { reason: "not-configured" });
+
       actionsCore.info(
-        `Not logging in to FlakeHub: GitHub Actions has not provided OIDC token endpoints; please make sure that \`id-token: write\` and \`contents: read\` are set for this step's (or job's) permissions.`,
+        "FlakeHub is disabled because the workflow is misconfigured. Please make sure that `id-token: write` and `contents: read` are set for this step's (or job's) permissions so that GitHub Actions provides OIDC token endpoints.",
       );
       actionsCore.info(
         `For more information, see https://docs.determinate.systems/guides/github-actions/#nix-installer-action`,
@@ -746,7 +750,8 @@ class NixInstallerAction extends DetSysAction {
       await actionsExec.exec(`determinate-nixd`, ["login", "github-action"]);
     } catch (e: unknown) {
       actionsCore.warning(`FlakeHub Login failure: ${stringifyError(e)}`);
-      this.recordEvent("flakehub-login:failure", {
+      this.recordEvent(EVENT_LOGIN_FAILURE, {
+        reason: "failed",
         exception: stringifyError(e),
       });
     }