Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

actions: Replace getsentry/action-github-app-token with custom code #28507

Merged
merged 1 commit into from
Jan 20, 2023
Merged

actions: Replace getsentry/action-github-app-token with custom code #28507

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 50 additions & 0 deletions .github/actions/gh-app-token/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
name: "Get GitHub App access token"
description: "Gets an access token for a GitHub App"
inputs:
app_id:
description: "App ID (not the client ID)."
private_key:
description: "App private key."
repo:
description: "Repository, if not the current one."
default: ${{ github.repository }}
outputs:
token:
description: "Access token."
value: ${{ steps.run.outputs.token }}
runs:
using: composite
steps:
- id: run
shell: bash
env:
ID: ${{ inputs.app_id }}
KEY: ${{ inputs.private_key }}
REPO: ${{ inputs.repo }}
run: |
HEADER=$( jq -cjn '{ alg: "RS256" }' | base64 -w 0 | tr -d $'=\n' | tr /+ _- )
PAYLOAD=$( jq -cjn --arg id "$ID" '{ iat: ( now | floor ), exp: ( now + 600 | floor ), "iss": ( $id | tonumber ) }' | base64 | tr -d $'=\n' | tr /+ _- )
SIGNATURE=$( printf "%s.%s" "$HEADER" "$PAYLOAD" | openssl dgst -sha256 -sign /dev/fd/3 -binary 3<<<"$KEY" | base64 | tr -d $'=\n' | tr /+ _- )
JWT_TOKEN=$HEADER.$PAYLOAD.$SIGNATURE

echo "::add-mask::$JWT_TOKEN"

JSON=$( curl -v -L --header "Authorization: Bearer $JWT_TOKEN" --url "https://api.github.com/repos/$REPO/installation" ) || { echo "::error::Failed to query installation from GitHub"; echo "$JSON"; exit 1; }
INSTALLATION_ID=$( jq -r '.id // ""' <<<"$JSON" )
if [[ -z "$INSTALLATION_ID" ]]; then
echo "::error::Failed to query installation from GitHub: $(jq -r '.message // "Unknown error"' <<<"$JSON")"
echo "$JSON"
exit 1
fi
echo "Installation ID: $INSTALLATION_ID"

JSON=$( curl -v -L --header "Authorization: Bearer $JWT_TOKEN" --url "https://api.github.com/app/installations/$INSTALLATION_ID/access_tokens" --data '{}' ) || { echo "::error::Failed to create installation access token"; echo "$JSON"; exit 1; }
INSTALLATION_TOKEN=$( jq -r '.token // ""' <<<"$JSON" )
if [[ -z "$INSTALLATION_TOKEN" ]]; then
echo "::error::Failed to create installation access token: $(jq -r '.message // "Unknown error"' <<<"$JSON")"
echo "$JSON"
exit 1
fi

echo "::add-mask::$INSTALLATION_TOKEN"
echo "token=$INSTALLATION_TOKEN" >> "$GITHUB_OUTPUT"
10 changes: 5 additions & 5 deletions .github/workflows/post-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ jobs:

- name: Get token
id: get_token
uses: getsentry/action-github-app-token@v2.0.0
uses: ./.github/actions/gh-app-token
with:
app_id: ${{ secrets.JP_LAUNCH_CONTROL_ID }}
private_key: ${{ secrets.JP_LAUNCH_CONTROL_KEY }}
Expand Down Expand Up @@ -67,7 +67,7 @@ jobs:

- name: Get token
id: get_token
uses: getsentry/action-github-app-token@v2.0.0
uses: ./.github/actions/gh-app-token
with:
app_id: ${{ secrets.JP_LAUNCH_CONTROL_ID }}
private_key: ${{ secrets.JP_LAUNCH_CONTROL_KEY }}
Expand Down Expand Up @@ -131,7 +131,7 @@ jobs:
- name: Get token
id: get_token
if: ${{ ! success() }}
uses: getsentry/action-github-app-token@v2.0.0
uses: ./.github/actions/gh-app-token
with:
app_id: ${{ secrets.JP_LAUNCH_CONTROL_ID }}
private_key: ${{ secrets.JP_LAUNCH_CONTROL_KEY }}
Expand Down Expand Up @@ -159,7 +159,7 @@ jobs:

- name: Get token
id: get_token
uses: getsentry/action-github-app-token@v2.0.0
uses: ./.github/actions/gh-app-token
with:
app_id: ${{ secrets.JP_LAUNCH_CONTROL_ID }}
private_key: ${{ secrets.JP_LAUNCH_CONTROL_KEY }}
Expand Down Expand Up @@ -212,7 +212,7 @@ jobs:

- name: Get token
id: get_token
uses: getsentry/action-github-app-token@v2.0.0
uses: ./monorepo/.github/actions/gh-app-token
env:
# Work around a weird node 16/openssl 3 issue in the docker env
OPENSSL_CONF: '/dev/null'
Expand Down