|
| 1 | +#!/usr/bin/env bash |
| 2 | + |
| 3 | +base64url() { |
| 4 | + openssl enc -base64 -A | tr '+/' '-_' | tr -d '=' |
| 5 | +} |
| 6 | + |
| 7 | +sign() { |
| 8 | + openssl dgst -binary -sha256 -sign <(printf '%s' "${PRIVATE_KEY}") |
| 9 | +} |
| 10 | + |
| 11 | +header="$(printf '{"alg":"RS256","typ":"JWT"}' | base64url)" |
| 12 | +now="$(date '+%s')" |
| 13 | +iat="$((now - 60))" |
| 14 | +exp="$((now + (3 * 60)))" |
| 15 | +template='{"iss":"%s","iat":%s,"exp":%s}' |
| 16 | +payload="$(printf "${template}" "${APP_ID}" "${iat}" "${exp}" | base64url)" |
| 17 | +echo "::add-mask::${payload}" |
| 18 | +signature="$(printf '%s' "${header}.${payload}" | sign | base64url)" |
| 19 | +echo "::add-mask::${signature}" |
| 20 | +jwt="${header}.${payload}.${signature}" |
| 21 | +echo "::add-mask::${jwt}" |
| 22 | + |
| 23 | +installation_id="$(curl --location --silent --request GET \ |
| 24 | + --url "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/installation" \ |
| 25 | + --header "Accept: application/vnd.github+json" \ |
| 26 | + --header "X-GitHub-Api-Version: 2022-11-28" \ |
| 27 | + --header "Authorization: Bearer ${jwt}" \ |
| 28 | + | jq -r '.id' |
| 29 | +)" |
| 30 | + |
| 31 | +repo_name="$(echo "${GITHUB_REPOSITORY}" | cut -d '/' -f 2)" |
| 32 | +token="$(curl --location --silent --request POST \ |
| 33 | + --url "${GITHUB_API_URL}/app/installations/${installation_id}/access_tokens" \ |
| 34 | + --header "Accept: application/vnd.github+json" \ |
| 35 | + --header "X-GitHub-Api-Version: 2022-11-28" \ |
| 36 | + --header "Authorization: Bearer ${jwt}" \ |
| 37 | + --data "$(printf '{"repositories":["%s"]}' "${repo_name}")" \ |
| 38 | + | jq -r '.token' |
| 39 | +)" |
| 40 | +echo "::add-mask::${token}" |
| 41 | +echo "token=${token}" >>"${GITHUB_OUTPUT}" |
0 commit comments