From 96449e0b06fd1e027d32d198a9599ab4ca0fbf3c Mon Sep 17 00:00:00 2001
From: whilefoo <whilefoo@users.noreply.github.com>
Date: Thu, 21 Nov 2024 23:57:19 +0100
Subject: [PATCH] fix: bypassSignatureVerification

---
 src/actions.ts | 9 ++++++---
 src/server.ts  | 3 +++
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/actions.ts b/src/actions.ts
index c5925d3..551a696 100644
--- a/src/actions.ts
+++ b/src/actions.ts
@@ -23,7 +23,10 @@ interface Options {
   envSchema?: TAnySchema;
   commandSchema?: TAnySchema;
   kernelPublicKey?: string;
-  disableSignatureVerification?: boolean; // only use for local development
+  /**
+   * @deprecated This disables signature verification - only for local development
+   */
+  bypassSignatureVerification?: boolean;
 }
 
 const inputSchema = T.Object({
@@ -48,7 +51,7 @@ export async function createActionsPlugin<TConfig = unknown, TEnv = unknown, TCo
     envSchema: options?.envSchema,
     commandSchema: options?.commandSchema,
     kernelPublicKey: options?.kernelPublicKey ?? KERNEL_PUBLIC_KEY,
-    disableSignatureVerification: options?.disableSignatureVerification || false,
+    bypassSignatureVerification: options?.bypassSignatureVerification || false,
   };
 
   const pluginGithubToken = process.env.PLUGIN_GITHUB_TOKEN;
@@ -59,7 +62,7 @@ export async function createActionsPlugin<TConfig = unknown, TEnv = unknown, TCo
 
   const body = github.context.payload.inputs;
   const signature = body.signature;
-  if (!pluginOptions.disableSignatureVerification && !(await verifySignature(pluginOptions.kernelPublicKey, body, signature))) {
+  if (!pluginOptions.bypassSignatureVerification && !(await verifySignature(pluginOptions.kernelPublicKey, body, signature))) {
     core.setFailed(`Error: Invalid signature`);
     return;
   }
diff --git a/src/server.ts b/src/server.ts
index 00eb713..aef78dd 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -20,6 +20,9 @@ interface Options {
   settingsSchema?: TAnySchema;
   envSchema?: TAnySchema;
   commandSchema?: TAnySchema;
+  /**
+   * @deprecated This disables signature verification - only for local development
+   */
   bypassSignatureVerification?: boolean;
 }