Support authenticated signing APIs in Action 0.6.2

RELEASE-NOTES.md

@@ -1,5 +1,3 @@
-# Release 0.6.1
+# Release 0.6.2
 
-Includes the reviewed September 2026 integrity, replay, persistence, async-lifecycle and compatibility repairs applicable to this repository. Wire/profile versions are unchanged unless explicitly described in the repository hardening notes.
-
-See HARDENING.md for supported verification scopes and migration boundaries. Registry publication and service deployment are reported by their workflows; a source merge alone is not a published package.
+Adds `jep_api_token` for authenticated API signing. Pass `${{ secrets.JEP_API_TOKEN }}`; the action masks the value in workflow logs. The committed Node 24 bundle is rebuilt and checked in CI.

VERSION

@@ -1 +1 @@
-0.6.1
+0.6.2

action.yml

@@ -39,6 +39,10 @@ inputs:
     description: "Optional JEP API URL for api mode"
     required: false
     default: ""
+  jep_api_token:
+    description: "Bearer token for authenticated API signing; pass a GitHub secret"
+    required: false
+    default: ""
   upload_artifact:
     description: "Upload the generated event artifact"
     required: false

package.json

@@ -1,6 +1,6 @@
 {
   "name": "jep-github-action",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "GitHub Action seed for generating JEP v0.6 event artifacts",
   "main": "dist/index.mjs",
   "type": "commonjs",

src/index.ts

@@ -18,6 +18,8 @@ async function run(): Promise<void> {
     const audience = core.getInput("audience") || github.context.repo.owner + "/" + github.context.repo.repo;
     const uploadArtifact = (core.getInput("upload_artifact") || "true").toLowerCase() === "true";
     const apiUrl = core.getInput("jep_api_url");
+    const apiToken = core.getInput("jep_api_token");
+    if (apiToken) core.setSecret(apiToken);
 
     let event = buildJepEvent({
       verb,
@@ -44,7 +46,7 @@ async function run(): Promise<void> {
       const response = await fetch(`${apiUrl.replace(/\/$/, "")}/events/create`, {
         method: "POST",
         signal: AbortSignal.timeout(30000),
-        headers: { "content-type": "application/json" },
+        headers: { "content-type": "application/json", ...(apiToken ? { authorization: `Bearer ${apiToken}` } : {}) },
         body: JSON.stringify({
           verb: event.verb,
           who: event.who,