fetch main lock via Octokit (#12)

README.md

@@ -19,6 +19,5 @@ Creates a comment inside Pull Request with the human-readable summary of the cha
 
 | Input | Required | Description |
 | --- | --- | --- |
-| `accessToken` | No | Personal access token to give action an access to private repository. Read more: https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token |
 | `path` | No | Path to the `yarn.lock` file in the repository. Default `yarn.lock` (project root). |
 | `token` | **Yes** | GitHub token for the bot, so it can publish a comment in the pull request. |

action.js

@@ -3,8 +3,8 @@ const github = require('@actions/github');
 const lockfile = require('@yarnpkg/lockfile');
 const compareVersions = require('compare-versions');
 const fs = require('fs');
+const { Base64 } = require('js-base64');
 const { markdownTable } = require('markdown-table');
-const fetch = require('node-fetch');
 const path = require('path');
 
 const GH_RAW_URL = 'https://raw.githubusercontent.com';
@@ -76,7 +76,6 @@ const run = async () => {
     const inputPath = core.getInput('path');
 
     const { owner, repo, number } = github.context.issue;
-    const { default_branch, temp_clone_token } = github.context.payload.repository;
 
     if (!number) {
       throw new Error('Cannot find the PR!');
@@ -91,15 +90,13 @@ const run = async () => {
     const content = await fs.readFileSync(lockPath, { encoding: 'utf8' });
     const updatedLock = lockfile.parse(content);
 
-    const response = await fetch(
-      `${GH_RAW_URL}/${owner}/${repo}/${default_branch}/${inputPath}?token=${temp_clone_token}`
-    );
+    const masterLockResponse = await octokit.request('GET /repos/{owner}/{repo}/contents/{path}', {
+      owner,
+      repo,
+      path: inputPath
+    });
 
-    if (!response) {
-      throw new Error('Cannot fetch current lock file!');
-    }
-
-    const masterLock = lockfile.parse(await response.text());
+    const masterLock = lockfile.parse(Base64.decode(masterLockResponse.data.content));
     const lockChanges = diffLocks(masterLock, updatedLock);
 
     if (Object.keys(lockChanges).length) {

action.yml

@@ -4,9 +4,6 @@ branding:
   icon: 'copy'
   color: 'purple'
 inputs:
-  accessToken:
-    description: 'Personal access token to give action an access to private repository.'
-    required: false
   path:
     description: 'Path to the `yarn.lock` file in the repository.'
     required: false

package.json

@@ -15,8 +15,8 @@
     "@actions/github": "^4.0.0",
     "@yarnpkg/lockfile": "^1.1.0",
     "compare-versions": "^3.6.0",
-    "markdown-table": "^3.0.0",
-    "node-fetch": "^2.6.1"
+    "js-base64": "^3.6.0",
+    "markdown-table": "^3.0.0"
   },
   "devDependencies": {
     "eslint": "^7.25.0",

yarn.lock

@@ -701,6 +701,11 @@ isexe@^2.0.0:
   resolved "https://registry.yarnpkg.com/isexe/-/isexe-2.0.0.tgz#e8fbf374dc556ff8947a10dcb0572d633f2cfa10"
   integrity sha1-6PvzdNxVb/iUehDcsFctYz8s+hA=
 
+js-base64@^3.6.0:
+  version "3.6.0"
+  resolved "https://registry.yarnpkg.com/js-base64/-/js-base64-3.6.0.tgz#773e1de628f4f298d65a7e9842c50244751f5756"
+  integrity sha512-wVdUBYQeY2gY73RIlPrysvpYx+2vheGo8Y1SNQv/BzHToWpAZzJU7Z6uheKMAe+GLSBig5/Ps2nxg/8tRB73xg==
+
 js-tokens@^4.0.0:
   version "4.0.0"
   resolved "https://registry.yarnpkg.com/js-tokens/-/js-tokens-4.0.0.tgz#19203fb59991df98e3a287050d4647cdeaf32499"