chore: migrate to biomejs (#1167)

* chore: migrate to biomejs * chore: migrate to biomejs * chore: migrate from jest to vitest * chore: error on lint warnings * chore: remove obsolete depedencies
2026-03-12 18:07:10 -04:00 · 2024-11-04 10:19:12 -08:00
parent d90c1f89e1
commit ccbdafa425
17 changed files with 4393 additions and 8410 deletions
--- a/.eslintignore
+++ b/.eslintignore
@@ -1,2 +0,0 @@
-build
-dist
--- a/.eslintrc.yml
+++ b/.eslintrc.yml
@@ -1,168 +0,0 @@
-env:
-  jest: true
-  node: true
-root: true
-plugins:
-  - import
-  - prettier
-parserOptions:
-  ecmaVersion: 2021
-  sourceType: module
-extends:
-  - plugin:prettier/recommended
-  - prettier
-rules:
-  prettier/prettier: [error]
-  import/no-extraneous-dependencies:
-    - error
-    - devDependencies:
-        - "**/test/**"
-        - "**/build-tools/**"
-      optionalDependencies: false
-      peerDependencies: true
-  import/no-unresolved: [error]
-  import/order:
-    - warn
-    - groups:
-        - builtin
-        - external
-      alphabetize:
-        order: asc
-        caseInsensitive: true
-  array-callback-return: [warn]
-  no-await-in-loop: [warn]
-  no-constant-binary-expression: [error]
-  no-constructor-return: [error]
-  no-duplicate-imports: [error]
-  no-self-compare: [warn]
-  no-template-curly-in-string: [error]
-  no-unmodified-loop-condition: [error]
-  no-unreachable-loop: [error]
-  no-unused-private-class-members: [error]
-  no-use-before-define: [error]
-  require-atomic-updates: [error]
-  block-scoped-var: [warn]
-  camelcase: [warn]
-  class-methods-use-this: [error]
-  consistent-return: [warn]
-  consistent-this: [warn]
-  default-case-last: [warn]
-  default-param-last: [warn]
-  dot-notation: [error]
-  eqeqeq: [error]
-  guard-for-in: [warn]
-  logical-assignment-operators:
-    - error
-    - always
-    - enforceForIfStatements: false
-  no-array-constructor: [error]
-  no-bitwise: [error]
-  no-console: [warn]
-  no-empty-function: [warn]
-  no-eval: [error]
-  no-extra-bind: [error]
-  no-labels: [error]
-  no-implicit-globals: [error]
-  no-invalid-this: [error]
-  key-spacing: [error]
-  no-multiple-empty-lines: [error]
-  no-return-await: [warn]
-  no-trailing-spaces: [error]
-  no-lonely-if: [error]
-  no-nested-ternary: [warn]
-  no-mixed-operators: [warn]
-  no-proto: [error]
-  no-sequences: [error]
-  no-throw-literal: [error]
-  no-useless-call: [error]
-  no-useless-concat: [warn]
-  no-var: [error]
-  one-var-declaration-per-line: [error]
-  prefer-const: [warn]
-  prefer-arrow-callback: [warn]
-  prefer-regex-literals: [warn]
-  prefer-promise-reject-errors: [warn]
-  prefer-spread: [warn]
-  prefer-template: [warn]
-  require-await: [error]
-overrides:
-  - files:
-      - '**/*.ts'
-    parser: '@typescript-eslint/parser'
-    parserOptions:
-      ecmaVersion: 2021
-      sourceType: module
-      project: ./tsconfig.json
-    extends:
-      - plugin:@typescript-eslint/recommended
-      - plugin:@typescript-eslint/recommended-requiring-type-checking
-      - plugin:import/typescript
-    rules:
-      '@typescript-eslint/array-type':
-        - warn
-        - default: array-simple
-      '@typescript-eslint/ban-tslint-comment': [error]
-      '@typescript-eslint/consistent-indexed-object-style': [warn]
-      '@typescript-eslint/consistent-type-assertions': [warn]
-      '@typescript-eslint/prefer-includes': [warn]
-      dot-notation: [off]
-      '@typescript-eslint/dot-notation': [error]
-      '@typescript-eslint/no-explicit-any': [off]
-      '@typescript-eslint/consistent-type-exports': [warn]
-      '@typescript-eslint/consistent-type-imports': [warn]
-      '@typescript-eslint/no-base-to-string': [error]
-      '@typescript-eslint/no-confusing-non-null-assertion': [warn]
-      '@typescript-eslint/no-invalid-void-type': [error]
-      '@typescript-eslint/no-meaningless-void-operator': [warn]
-      '@typescript-eslint/no-redundant-type-constituents': [warn]
-      '@typescript-eslint/no-unnecessary-boolean-literal-compare': [warn]
-      '@typescript-eslint/no-unnecessary-condition': [warn]
-      '@typescript-eslint/no-unnecessary-qualifier': [warn]
-      '@typescript-eslint/no-unnecessary-type-arguments': [warn]
-      '@typescript-eslint/non-nullable-type-assertion-style': [warn]
-      '@typescript-eslint/prefer-for-of': [error]
-      '@typescript-eslint/prefer-literal-enum-member': [warn]
-      '@typescript-eslint/prefer-optional-chain': [warn]
-      '@typescript-eslint/prefer-readonly': [warn]
-      '@typescript-eslint/prefer-regexp-exec': [warn]
-      '@typescript-eslint/prefer-string-starts-ends-with': [warn]
-      '@typescript-eslint/prefer-ts-expect-error': [error]
-      '@typescript-eslint/promise-function-async': [warn]
-      '@typescript-eslint/require-array-sort-compare': [error]
-      default-param-last: [off]
-      '@typescript-eslint/default-param-last': [warn]
-      no-array-constructor: [off]
-      '@typescript-eslint/no-array-constructor': [error]
-      no-dupe-class-members: [off]
-      '@typescript-eslint/no-dupe-class-members': [warn]
-      no-invalid-this: [off]
-      '@typescript-eslint/no-invalid-this': [warn]
-      no-unused-vars: [off]
-      '@typescript-eslint/no-unused-vars':
-        - error
-        - varsIgnorePattern: '^_'
-          argsIgnorePattern: '^_'
-          caughtErrorsIgnorePattern: '^_'
-      '@typescript-eslint/no-non-null-assertion': [off]
-      '@typescript-eslint/no-require-imports':
-        - error
-      no-return-await: [off]
-      '@typescript-eslint/return-await': [error]
-      no-shadow: [off]
-      '@typescript-eslint/no-shadow': [error]
-      '@typescript-eslint/no-floating-promises': [error]
-      "@typescript-eslint/member-ordering":
-        - error
-        - default:
-          - public-static-field
-          - public-static-method
-          - protected-static-field
-          - protected-static-method
-          - private-static-field
-          - private-static-method
-          - field
-          - constructor
-          - method
-      no-use-before-define: [off]
-      '@typescript-eslint/no-use-before-define': [error]
-      no-duplicate-imports: [off]
--- a/.prettierrc.json
+++ b/.prettierrc.json
@@ -1,8 +0,0 @@
-{
-  "printWidth": 120,
-  "semi": true,
-  "singleQuote": true,
-  "trailingComma": "es5",
-  "bracketSpacing": true,
-  "overrides": []
-}
--- a/mocks/fs.cjs
+++ b/mocks/fs.cjs
@@ -0,0 +1,2 @@
+const { fs } = require('memfs')
+module.exports = fs
--- a/biome.jsonc
+++ b/biome.jsonc
@@ -0,0 +1,34 @@
+{
+  "formatter": {
+    "indentStyle": "space",
+    "lineWidth": 120,
+    "indentWidth": 2,
+    "lineEnding": "lf",
+    "enabled": true,
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "performance": {
+        "noDelete": "off",
+      },
+      "complexity": {
+        "noExtraBooleanCast": "off",
+      }
+    },
+  },
+  "javascript": {
+    "formatter": {
+      "trailingCommas": "all",
+      "jsxQuoteStyle": "double",
+      "quoteStyle": "single",
+      "bracketSpacing": true,
+      "arrowParentheses": "always",
+    },
+  },
+  "json": {
+    "formatter": {
+      "trailingCommas": "all",
+    },
+  },
+}
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -3,9 +3,9 @@
  "description": "A GitHub Action to configure AWS credentials",
  "scripts": {
    "build": "tsc --project tsconfig.build.json",
-    "lint": "eslint .",
-    "package": "npm run build && ncc build --license THIRD-PARTY -o dist && ncc build src/cleanup/index.ts -o dist/cleanup && copyup -E dist/THIRD-PARTY . && del-cli dist/THIRD-PARTY",
-    "test": "npm run lint && jest --verbose"
+    "lint": "biome check --error-on-warnings ./src",
+    "package": "npm run build && ncc build --license THIRD-PARTY -o dist && ncc build src/cleanup/index.ts -o dist/cleanup && cpy -E dist/THIRD-PARTY . && del-cli dist/THIRD-PARTY",
+    "test": "npm run lint && vitest run"
  },
  "author": {
    "name": "Amazon.com, Inc. or its affiliates",
@@ -14,35 +14,25 @@
  },
  "devDependencies": {
    "@aws-sdk/credential-provider-env": "^3.515.0",
-    "@smithy/property-provider": "^3.1.8",
-    "@jest/globals": "^29.7.0",
-    "@types/jest": "^29.5.14",
-    "@types/node": "^22",
-    "@typescript-eslint/eslint-plugin": "<=5.62.0",
-    "@typescript-eslint/parser": "<=5.62.0",
+    "@biomejs/biome": "1.9.4",
+    "@smithy/property-provider": "^3.1.7",
+    "@types/node": "^22.7.7",
    "@vercel/ncc": "^0.38.2",
+    "@vitest/coverage-v8": "^2.1.3",
    "aws-sdk-client-mock": "^4.1.0",
-    "copyfiles": "^2.4.1",
+    "cpy-cli": "^5.0.0",
    "del-cli": "^6.0.0",
-    "eslint": "^8",
-    "eslint-config-prettier": "^9.1.0",
-    "eslint-import-resolver-node": "^0.3.6",
-    "eslint-import-resolver-typescript": "^3.6.3",
-    "eslint-plugin-import": "^2.31.0",
-    "eslint-plugin-prettier": "^5.2.1",
-    "jest": "^29.7.0",
-    "jest-junit": "^16",
    "json-schema": "^0.4.0",
-    "prettier": "^3.3.3",
-    "standard-version": "^9",
-    "ts-jest": "^29.2.5",
-    "typescript": "^5.6.3"
+    "memfs": "^4.14.0",
+    "standard-version": "^9.5.0",
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.3"
  },
  "dependencies": {
    "@actions/core": "^1.11.1",
-    "@aws-sdk/client-sts": "^3",
-    "@smithy/node-http-handler": "^3.2.5",
-    "https-proxy-agent": "^5.0.0"
+    "@aws-sdk/client-sts": "^3.675.0",
+    "@smithy/node-http-handler": "^3.2.4",
+    "https-proxy-agent": "^5.0.1"
  },
  "keywords": [
    "aws",
--- a/src/CredentialsClient.ts
+++ b/src/CredentialsClient.ts
@@ -1,5 +1,6 @@
 import { info } from '@actions/core';
 import { STSClient } from '@aws-sdk/client-sts';
+import type { AwsCredentialIdentity } from '@aws-sdk/types';
 import { NodeHttpHandler } from '@smithy/node-http-handler';
 import { HttpsProxyAgent } from 'https-proxy-agent';
 import { errorMessage } from './helpers';
@@ -40,7 +41,7 @@ export class CredentialsClient {
  }

  public async validateCredentials(expectedAccessKeyId?: string, roleChaining?: boolean) {
-    let credentials;
+    let credentials: AwsCredentialIdentity;
    try {
      credentials = await this.loadCredentials();
      if (!credentials.accessKeyId) {
@@ -55,7 +56,7 @@ export class CredentialsClient {

      if (expectedAccessKeyId && expectedAccessKeyId !== actualAccessKeyId) {
        throw new Error(
-          'Unexpected failure: Credentials loaded by the SDK do not match the access key ID configured by the action'
+          'Unexpected failure: Credentials loaded by the SDK do not match the access key ID configured by the action',
        );
      }
    }
--- a/src/assumeRole.ts
+++ b/src/assumeRole.ts
@@ -1,6 +1,6 @@
-import assert from 'assert';
-import fs from 'fs';
-import path from 'path';
+import assert from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
 import * as core from '@actions/core';
 import type { AssumeRoleCommandInput, STSClient, Tag } from '@aws-sdk/client-sts';
 import { AssumeRoleCommand, AssumeRoleWithWebIdentityCommand } from '@aws-sdk/client-sts';
@@ -15,7 +15,7 @@ async function assumeRoleWithOIDC(params: AssumeRoleCommandInput, client: STSCli
      new AssumeRoleWithWebIdentityCommand({
        ...params,
        WebIdentityToken: webIdentityToken,
-      })
+      }),
    );
    return creds;
  } catch (error) {
@@ -27,10 +27,10 @@ async function assumeRoleWithWebIdentityTokenFile(
  params: AssumeRoleCommandInput,
  client: STSClient,
  webIdentityTokenFile: string,
-  workspace: string
+  workspace: string,
 ) {
  core.debug(
-    'webIdentityTokenFile provided. Will call sts:AssumeRoleWithWebIdentity and take session tags from token contents.'
+    'webIdentityTokenFile provided. Will call sts:AssumeRoleWithWebIdentity and take session tags from token contents.',
  );
  const webIdentityTokenFilePath = path.isAbsolute(webIdentityTokenFile)
    ? webIdentityTokenFile
@@ -46,7 +46,7 @@ async function assumeRoleWithWebIdentityTokenFile(
      new AssumeRoleWithWebIdentityCommand({
        ...params,
        WebIdentityToken: webIdentityToken,
-      })
+      }),
    );
    return creds;
  } catch (error) {
@@ -75,7 +75,7 @@ export interface assumeRoleParams {
  webIdentityTokenFile?: string;
  webIdentityToken?: string;
  inlineSessionPolicy?: string;
-  managedSessionPolicies?: any[];
+  managedSessionPolicies?: { arn: string }[];
 }

 export async function assumeRole(params: assumeRoleParams) {
@@ -108,8 +108,11 @@ export async function assumeRole(params: assumeRoleParams) {
    { Key: 'Actor', Value: sanitizeGitHubVariables(GITHUB_ACTOR) },
    { Key: 'Commit', Value: GITHUB_SHA },
  ];
-  if (process.env['GITHUB_REF']) {
-    tagArray.push({ Key: 'Branch', Value: sanitizeGitHubVariables(process.env['GITHUB_REF']) });
+  if (process.env.GITHUB_REF) {
+    tagArray.push({
+      Key: 'Branch',
+      Value: sanitizeGitHubVariables(process.env.GITHUB_REF),
+    });
  }
  const tags = roleSkipSessionTagging ? undefined : tagArray;
  if (!tags) {
@@ -123,7 +126,7 @@ export async function assumeRole(params: assumeRoleParams) {
  if (!roleArn.startsWith('arn:aws')) {
    assert(
      isDefined(sourceAccountId),
-      'Source Account ID is needed if the Role Name is provided and not the Role Arn.'
+      'Source Account ID is needed if the Role Name is provided and not the Role Arn.',
    );
    roleArn = `arn:aws:iam::${sourceAccountId}:role/${roleArn}`;
  }
@@ -139,6 +142,7 @@ export async function assumeRole(params: assumeRoleParams) {
    PolicyArns: managedSessionPolicies?.length ? managedSessionPolicies : undefined,
  };
  const keys = Object.keys(commonAssumeRoleParams) as Array<keyof typeof commonAssumeRoleParams>;
+  // biome-ignore lint/complexity/noForEach: Legacy code
  keys.forEach((k) => commonAssumeRoleParams[k] === undefined && delete commonAssumeRoleParams[k]);

  // Instantiate STS client
@@ -147,14 +151,14 @@ export async function assumeRole(params: assumeRoleParams) {
  // Assume role using one of three methods
  if (!!webIdentityToken) {
    return assumeRoleWithOIDC(commonAssumeRoleParams, stsClient, webIdentityToken);
-  } else if (!!webIdentityTokenFile) {
+  }
+  if (!!webIdentityTokenFile) {
    return assumeRoleWithWebIdentityTokenFile(
      commonAssumeRoleParams,
      stsClient,
      webIdentityTokenFile,
-      GITHUB_WORKSPACE
+      GITHUB_WORKSPACE,
    );
-  } else {
+  }
  return assumeRoleWithCredentials(commonAssumeRoleParams, stsClient);
 }
-}
--- a/src/helpers.ts
+++ b/src/helpers.ts
@@ -23,7 +23,7 @@ export function exportCredentials(creds?: Partial<Credentials>, outputCredential
  if (creds?.SessionToken) {
    core.setSecret(creds.SessionToken);
    core.exportVariable('AWS_SESSION_TOKEN', creds.SessionToken);
-  } else if (process.env['AWS_SESSION_TOKEN']) {
+  } else if (process.env.AWS_SESSION_TOKEN) {
    // clear session token from previous credentials action
    core.exportVariable('AWS_SESSION_TOKEN', '');
  }
@@ -116,7 +116,7 @@ export async function retryAndBackoff<T>(
  isRetryable: boolean,
  maxRetries = 12,
  retries = 0,
-  base = 50
+  base = 50,
 ): Promise<T> {
  try {
    return await fn();
@@ -125,7 +125,8 @@ export async function retryAndBackoff<T>(
      throw err;
    }
    // It's retryable, so sleep and retry.
-    await sleep(Math.random() * (Math.pow(2, retries) * base));
+    await sleep(Math.random() * (2 ** retries * base));
+    // biome-ignore lint/style/noParameterAssign: This is a loop variable
    retries += 1;
    if (retries >= maxRetries) {
      throw err;
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,13 +1,13 @@
 import * as core from '@actions/core';
 import type { AssumeRoleCommandOutput } from '@aws-sdk/client-sts';
-import { assumeRole } from './assumeRole';
 import { CredentialsClient } from './CredentialsClient';
+import { assumeRole } from './assumeRole';
 import {
  errorMessage,
-  retryAndBackoff,
-  exportRegion,
-  exportCredentials,
  exportAccountId,
+  exportCredentials,
+  exportRegion,
+  retryAndBackoff,
  unsetCredentials,
  verifyKeys,
 } from './helpers';
@@ -20,24 +20,35 @@ export async function run() {
  try {
    // Get inputs
    const AccessKeyId = core.getInput('aws-access-key-id', { required: false });
-    const SecretAccessKey = core.getInput('aws-secret-access-key', { required: false });
-    const sessionTokenInput = core.getInput('aws-session-token', { required: false });
+    const SecretAccessKey = core.getInput('aws-secret-access-key', {
+      required: false,
+    });
+    const sessionTokenInput = core.getInput('aws-session-token', {
+      required: false,
+    });
    const SessionToken = sessionTokenInput === '' ? undefined : sessionTokenInput;
    const region = core.getInput('aws-region', { required: true });
    const roleToAssume = core.getInput('role-to-assume', { required: false });
    const audience = core.getInput('audience', { required: false });
    const maskAccountIdInput = core.getInput('mask-aws-account-id', { required: false }) || 'false';
    const maskAccountId = maskAccountIdInput.toLowerCase() === 'true';
-    const roleExternalId = core.getInput('role-external-id', { required: false });
-    const webIdentityTokenFile = core.getInput('web-identity-token-file', { required: false });
-    const roleDuration = parseInt(core.getInput('role-duration-seconds', { required: false })) || DEFAULT_ROLE_DURATION;
+    const roleExternalId = core.getInput('role-external-id', {
+      required: false,
+    });
+    const webIdentityTokenFile = core.getInput('web-identity-token-file', {
+      required: false,
+    });
+    const roleDuration =
+      Number.parseInt(core.getInput('role-duration-seconds', { required: false })) || DEFAULT_ROLE_DURATION;
    const roleSessionName = core.getInput('role-session-name', { required: false }) || ROLE_SESSION_NAME;
    const roleSkipSessionTaggingInput = core.getInput('role-skip-session-tagging', { required: false }) || 'false';
    const roleSkipSessionTagging = roleSkipSessionTaggingInput.toLowerCase() === 'true';
    const proxyServer = core.getInput('http-proxy', { required: false });
-    const inlineSessionPolicy = core.getInput('inline-session-policy', { required: false });
+    const inlineSessionPolicy = core.getInput('inline-session-policy', {
+      required: false,
+    });
    const managedSessionPoliciesInput = core.getMultilineInput('managed-session-policies', { required: false });
-    const managedSessionPolicies: any[] = [];
+    const managedSessionPolicies: { arn: string }[] = [];
    const roleChainingInput = core.getInput('role-chaining', { required: false }) || 'false';
    const roleChaining = roleChainingInput.toLowerCase() === 'true';
    const outputCredentialsInput = core.getInput('output-credentials', { required: false }) || 'false';
@@ -49,7 +60,7 @@ export async function run() {
    const specialCharacterWorkaroundInput =
      core.getInput('special-characters-workaround', { required: false }) || 'false';
    const specialCharacterWorkaround = specialCharacterWorkaroundInput.toLowerCase() === 'true';
-    let maxRetries = parseInt(core.getInput('retry-max-attempts', { required: false })) || 12;
+    let maxRetries = Number.parseInt(core.getInput('retry-max-attempts', { required: false })) || 12;
    switch (true) {
      case specialCharacterWorkaround:
        // 😳
@@ -74,17 +85,17 @@ export async function run() {
        !!roleToAssume &&
        !webIdentityTokenFile &&
        !AccessKeyId &&
-        !process.env['ACTIONS_ID_TOKEN_REQUEST_TOKEN'] &&
+        !process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN &&
        !roleChaining
      ) {
        core.info(
          'It looks like you might be trying to authenticate with OIDC. Did you mean to set the `id-token` permission? ' +
-            'If you are not trying to authenticate with OIDC and the action is working successfully, you can ignore this message.'
+            'If you are not trying to authenticate with OIDC and the action is working successfully, you can ignore this message.',
        );
      }
      return (
        !!roleToAssume &&
-        !!process.env['ACTIONS_ID_TOKEN_REQUEST_TOKEN'] &&
+        !!process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN &&
        !AccessKeyId &&
        !webIdentityTokenFile &&
        !roleChaining
@@ -114,7 +125,7 @@ export async function run() {
            return core.getIDToken(audience);
          },
          !disableRetry,
-          maxRetries
+          maxRetries,
        );
      } catch (error) {
        throw new Error(`getIDToken call failed: ${errorMessage(error)}`);
@@ -146,7 +157,6 @@ export async function run() {
    if (roleToAssume) {
      let roleCredentials: AssumeRoleCommandOutput;
      do {
-        // eslint-disable-next-line no-await-in-loop
        roleCredentials = await retryAndBackoff(
          async () => {
            return assumeRole({
@@ -164,17 +174,16 @@ export async function run() {
            });
          },
          !disableRetry,
-          maxRetries
+          maxRetries,
        );
-        // eslint-disable-next-line no-unmodified-loop-condition
      } while (specialCharacterWorkaround && !verifyKeys(roleCredentials.Credentials));
-      core.info(`Authenticated as assumedRoleId ${roleCredentials.AssumedRoleUser!.AssumedRoleId!}`);
+      core.info(`Authenticated as assumedRoleId ${roleCredentials.AssumedRoleUser?.AssumedRoleId}`);
      exportCredentials(roleCredentials.Credentials, outputCredentials);
      // We need to validate the credentials in 2 of our use-cases
      // First: self-hosted runners. If the GITHUB_ACTIONS environment variable
      //  is set to `true` then we are NOT in a self-hosted runner.
      // Second: Customer provided credentials manually (IAM User keys stored in GH Secrets)
-      if (!process.env['GITHUB_ACTIONS'] || AccessKeyId) {
+      if (!process.env.GITHUB_ACTIONS || AccessKeyId) {
        await credentialsClient.validateCredentials(roleCredentials.Credentials?.AccessKeyId);
      }
      await exportAccountId(credentialsClient, maskAccountId);
@@ -184,7 +193,7 @@ export async function run() {
  } catch (error) {
    core.setFailed(errorMessage(error));

-    const showStackTrace = process.env['SHOW_STACK_TRACE'];
+    const showStackTrace = process.env.SHOW_STACK_TRACE;

    if (showStackTrace === 'true') {
      throw error;
--- a/test/cleanup.test.ts
+++ b/test/cleanup.test.ts
@@ -1,35 +1,34 @@
-import * as core from '@actions/core';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { cleanup } from '../src/cleanup';
+import * as core from '@actions/core';
+import { mockClient } from 'aws-sdk-client-mock';
+import { STSClient } from '@aws-sdk/client-sts';
+import mocks from './mockinputs.test';

-const FAKE_ACCESS_KEY_ID = 'MY-AWS-ACCESS-KEY-ID';
-const FAKE_SECRET_ACCESS_KEY = 'MY-AWS-SECRET-ACCESS-KEY';
-const FAKE_SESSION_TOKEN = 'MY-AWS-SESSION-TOKEN';
-const FAKE_REGION = 'fake-region-1';
-const ACTION_ENVIRONMENT_VARIABLES = {
-  AWS_ACCESS_KEY_ID: FAKE_ACCESS_KEY_ID,
-  AWS_SECRET_ACCESS_KEY: FAKE_SECRET_ACCESS_KEY,
-  AWS_SESSION_TOKEN: FAKE_SESSION_TOKEN,
-  AWS_DEFAULT_REGION: FAKE_REGION,
-  AWS_REGION: FAKE_REGION,
-};
-
-describe('Configure AWS Credentials', () => {
-  const OLD_ENV = process.env;
+const mockedSTSClient = mockClient(STSClient);

+describe('Configure AWS Credentials cleanup', {}, () => {
  beforeEach(() => {
-    jest.resetModules();
-    jest.spyOn(core, 'exportVariable').mockImplementation();
-    jest.spyOn(core, 'setSecret').mockImplementation();
-    jest.spyOn(core, 'setOutput').mockImplementation();
-    jest.spyOn(core, 'setFailed').mockImplementation();
-    process.env = { ...OLD_ENV, ...ACTION_ENVIRONMENT_VARIABLES };
+    // Reset mock state
+    vi.restoreAllMocks();
+    mockedSTSClient.reset();
+    // Mock GitHub Actions core functions
+    vi.spyOn(core, 'exportVariable').mockImplementation((_n, _v) => {});
+    vi.spyOn(core, 'setSecret').mockImplementation((_s) => {});
+    vi.spyOn(core, 'setFailed').mockImplementation((_m) => {});
+    vi.spyOn(core, 'setOutput').mockImplementation((_n, _v) => {});
+    vi.spyOn(core, 'debug').mockImplementation((_m) => {});
+    vi.spyOn(core, 'info').mockImplementation((_m) => {});
+    process.env = {
+      ...mocks.envs,
+      AWS_ACCESS_KEY_ID: 'CLEANUPTEST',
+      AWS_SECRET_ACCESS_KEY: 'CLEANUPTEST',
+      AWS_SESSION_TOKEN: 'CLEANUPTEST',
+      AWS_REGION: 'CLEANUPTEST',
+      AWS_DEFAULT_REGION: 'CLEANUPTEST',
+    };
  });
-
-  afterEach(() => {
-    process.env = OLD_ENV;
-  });
-
-  test('replaces AWS credential and region env vars with empty strings', () => {
+  it('replaces AWS credential and region environment variables with empty strings', {}, () => {
    cleanup();
    expect(core.setFailed).toHaveBeenCalledTimes(0);
    expect(core.exportVariable).toHaveBeenCalledTimes(5);
@@ -39,14 +38,11 @@ describe('Configure AWS Credentials', () => {
    expect(core.exportVariable).toHaveBeenCalledWith('AWS_DEFAULT_REGION', '');
    expect(core.exportVariable).toHaveBeenCalledWith('AWS_REGION', '');
  });
-
-  test('error is caught and fails the action', () => {
-    jest.spyOn(core, 'exportVariable').mockImplementation(() => {
-      throw new Error();
+  it('handles errors', {}, () => {
+    vi.spyOn(core, 'exportVariable').mockImplementationOnce(() => {
+      throw new Error('Test error');
    });
-
    cleanup();
-
    expect(core.setFailed).toHaveBeenCalled();
  });
 });
--- a/test/helpers.test.ts
+++ b/test/helpers.test.ts
@@ -1,26 +1,45 @@
+import { describe, it, expect, vi } from 'vitest';
 import * as helpers from '../src/helpers';
-describe('helpers', () => {
+import * as core from '@actions/core';
+import { before, beforeEach } from 'node:test';
+
+describe('Configure AWS Credentials helpers', {}, () => {
  beforeEach(() => {
-    jest.resetModules();
-    jest.clearAllMocks();
+    vi.restoreAllMocks();
  });
-
-  test('removes brackets from GitHub Actor', () => {
-    expect(helpers.sanitizeGitHubVariables('foo[bot]')).toEqual('foo_bot_');
+  it('removes brackets from GitHub Actor', {}, () => {
+    const actor = 'actor[bot]';
+    expect(helpers.sanitizeGitHubVariables(actor)).toBe('actor_bot_');
  });
-
-  test('removes special characters from worflow names', () => {
+  it('can sleep', {}, () => {
+    const sleep = helpers.defaultSleep(10);
+    expect(Promise.race([sleep, new Promise((_, reject) => setTimeout(reject, 20))])).resolves.toBe(undefined);
+  });
+  it('removes special characters from workflow names', {}, () => {
    expect(helpers.sanitizeGitHubVariables('sdf234@#$%$^&*()_+{}|:"<>?')).toEqual('sdf234@__________+___:____');
  });
-
-  test('can sleep', () => {
-    const sleep = helpers.defaultSleep(10);
-    expect(Promise.race([sleep, new Promise((_res, rej) => setTimeout(rej, 20))])).resolves;
-  });
-
-  test("backoff function doesn't retry non-retryable errors", async () => {
-    const fn = jest.fn().mockRejectedValue('i am not retryable');
+  it("doesn't retry non-retryable errors", {}, async () => {
+    const fn = vi.fn().mockRejectedValue('i am not retryable');
    await expect(helpers.retryAndBackoff(fn, false)).rejects.toMatch('i am not retryable');
    expect(fn).toHaveBeenCalledTimes(1);
  });
+  it('can output creds when told to', {}, () => {
+    vi.spyOn(core, 'setOutput').mockImplementation(() => {});
+    vi.spyOn(core, 'setSecret').mockImplementation(() => {});
+    vi.spyOn(core, 'exportVariable').mockImplementation(() => {});
+    helpers.exportCredentials({ AccessKeyId: 'test', SecretAccessKey: 'test', SessionToken: 'test' }, true);
+    expect(core.setOutput).toHaveBeenCalledTimes(3);
+    expect(core.setSecret).toHaveBeenCalledTimes(3);
+    expect(core.exportVariable).toHaveBeenCalledTimes(3);
+  });
+  it('can unset credentials', {}, () => {
+    const env = process.env;
+    helpers.unsetCredentials();
+    expect(process.env.AWS_ACCESS_KEY_ID).toBeUndefined;
+    expect(process.env.AWS_SECRET_ACCESS_KEY).toBeUndefined;
+    expect(process.env.AWS_SESSION_TOKEN).toBeUndefined;
+    expect(process.env.AWS_REGION).toBeUndefined;
+    expect(process.env.AWS_DEFAULT_REGION).toBeUndefined;
+    process.env = env;
+  });
 });
--- a/test/index.test.ts
+++ b/test/index.test.ts
--- a/test/mockinputs.test.ts
+++ b/test/mockinputs.test.ts
@@ -0,0 +1,98 @@
+import type * as core from '@actions/core';
+
+const inputs = {
+  GH_OIDC_INPUTS: {
+    'role-to-assume': 'arn:aws:iam::111111111111:role/MY-ROLE',
+    'aws-region': 'fake-region-1',
+    'special-characters-workaround': 'true',
+  },
+  IAM_USER_INPUTS: {
+    'aws-access-key-id': 'MYAWSACCESSKEYID',
+    'aws-secret-access-key': 'MYAWSSECRETACCESSKEY',
+    'aws-region': 'fake-region-1',
+  },
+  IAM_ASSUMEROLE_INPUTS: {
+    'aws-access-key-id': 'MYAWSACCESSKEYID',
+    'aws-secret-access-key': 'MYAWSSECRETACCESSKEY',
+    'role-to-assume': 'arn:aws:iam::111111111111:role/MY-ROLE',
+    'aws-region': 'fake-region-1',
+  },
+  WEBIDENTITY_TOKEN_FILE_INPUTS: {
+    'web-identity-token-file': 'file.txt',
+    'role-to-assume': 'arn:aws:iam::111111111111:role/MY-ROLE',
+    'aws-region': 'fake-region-1',
+  },
+  EXISTING_ROLE_INPUTS: {
+    'role-to-assume': 'arn:aws:iam::111111111111:role/MY-ROLE',
+    'role-chaining': 'true',
+    'aws-region': 'fake-region-1',
+  },
+};
+
+const envs = {
+  GITHUB_REPOSITORY: 'MY-REPOSITORY-NAME',
+  GITHUB_WORKFLOW: 'MY-WORKFLOW-ID',
+  GITHUB_ACTION: 'MY-ACTION-NAME',
+  GITHUB_ACTOR: 'MY-USERNAME[bot]',
+  GITHUB_SHA: 'MY-COMMIT-ID',
+  GITHUB_WORKSPACE: '/home/github',
+  GITHUB_ACTIONS: 'true',
+};
+
+const outputs = {
+  STS_CREDENTIALS: {
+    Credentials: {
+      AccessKeyId: 'STSAWSACCESSKEYID',
+      SecretAccessKey: 'STSAWSSECRETACCESSKEY',
+      SessionToken: 'STSAWSSESSIONTOKEN',
+      Expiration: new Date(8640000000000000),
+    },
+    AssumedRoleUser: {
+      Arn: 'arn:aws:sts::111111111111:assumed-role/MY-ROLE/',
+      AssumedRoleId: 'AROAFAKEASSUMEDROLEID',
+    },
+  },
+  GET_CALLER_IDENTITY: {
+    Account: '111111111111',
+    Arn: 'arn:aws:iam::111111111111:role/MY-ROLE',
+  },
+  FAKE_STS_ACCESS_KEY_ID: 'STSAWSACCESSKEYID',
+  FAKE_STS_SECRET_ACCESS_KEY: 'STSAWSSECRETACCESSKEY',
+  FAKE_STS_SESSION_TOKEN: 'STSAWSSESSIONTOKEN',
+  ODD_CHARACTER_CREDENTIALS: {
+    Credentials: {
+      AccessKeyId: 'STSA#$%^&',
+      SecretAccessKey: 'STSA#$%^&Key',
+      SessionToken: 'STSA#$%^',
+      Expiration: new Date(8640000000000000),
+    },
+    AssumedRoleUser: {
+      Arn: 'arn:aws:sts::111111111111:assumed-role/MY-ROLE/',
+      AssumedRoleId: 'AROAFAKEASSUMEDROLEID',
+    },
+  },
+};
+
+export default {
+  getInput: (fakeEnv: Record<string, string>) => {
+    return (name: string, options?: core.InputOptions): string => {
+      if (!fakeEnv[name]) {
+        if (options?.required) throw new Error(`Input ${name} not found`);
+        return '';
+      }
+      return fakeEnv[name];
+    };
+  },
+  getMultilineInput: (fakeEnv: Record<string, string[]>) => {
+    return (name: string, options?: core.InputOptions): string[] => {
+      if (!fakeEnv[name]) {
+        if (options?.required) throw new Error(`Input ${name} not found`);
+        return [];
+      }
+      return fakeEnv[name];
+    };
+  },
+  ...inputs,
+  outputs,
+  envs,
+} as const;
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -7,9 +7,8 @@
    "noFallthroughCasesInSwitch": true,
    "noImplicitOverride": true,
    "noImplicitReturns": true,
-    "noPropertyAccessFromIndexSignature": true,
+    "noPropertyAccessFromIndexSignature": false,
    "noUncheckedIndexedAccess": true,
-    "noUnusedLocals": true,
    "noUnusedParameters": true,
    "module": "CommonJS",
    "resolveJsonModule": true,
@@ -27,7 +26,7 @@
  },
  "include": [
    "src/**/*.ts",
-    "test/**/*.ts"
+    "test/**/*.test.ts"
  ],
  "exclude": [],
 }
--- a/vitest.config.mts
+++ b/vitest.config.mts
@@ -0,0 +1,9 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    passWithNoTests: true,
+    include: ['test/**/*.test.ts'],
+    coverage: { enabled: true },
+  },
+});