.github/workflows/token.yml #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| permissions: | |
| id-token: write # This is required for requesting the JWT | |
| contents: read # This is required for actions/checkout | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| audience: | |
| description: "Audience for the OIDC token" | |
| required: true | |
| default: "api.tailscale.com/kSKXZuvWGU11CNTRL" | |
| client_id: | |
| description: "Client ID for the Tailscale OIDC JWT exchange" | |
| required: true | |
| default: "TbqNGJkY5611CNTRL/kSKXZuvWGU11CNTRL" | |
| tailnet: | |
| description: "Tailnet name for the demo API request" | |
| required: true | |
| default: "keiretsu-labs.org.github" | |
| jobs: | |
| echo-token: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: get OIDC token from GitHub Actions | |
| id: get_oidc_token | |
| run: | | |
| JWT=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${{ inputs.audience }}" | jq -r '.value') | |
| echo "::add-mask::$JWT" # Mask the JWT in the logs | |
| echo "jwt=$JWT" >> $GITHUB_OUTPUT | |
| - name: perform OIDC token exchange | |
| run: | | |
| # Perform the OIDC token exchange with Tailscale | |
| echo "Exchanging OIDC token with Tailscale..." | |
| RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}" -X POST https://api.tailscale.com/api/v2/oauth/token-exchange \ | |
| -H "Content-Type: application/x-www-form-urlencoded" \ | |
| -d "client_id=${{ inputs.client_id}}" \ | |
| -d "jwt=${{ steps.get_oidc_token.outputs.jwt }}") | |
| # Extract HTTP status and response body | |
| HTTP_STATUS=$(echo "$RESPONSE" | tail -n 1 | cut -d: -f2) | |
| RESPONSE_BODY=$(echo "$RESPONSE" | sed '$d') | |
| echo "HTTP Status: $HTTP_STATUS" | |
| echo "Response body: $RESPONSE_BODY" | |
| # Check if the request was successful | |
| if [ "$HTTP_STATUS" != "200" ]; then | |
| echo "Error: Token exchange failed with status $HTTP_STATUS" | |
| echo "Full response: $RESPONSE_BODY" | |
| exit 1 | |
| fi | |
| # Extract access token | |
| ACCESS_TOKEN=$(echo "$RESPONSE_BODY" | jq -r '.access_token') | |
| if [ "$ACCESS_TOKEN" == "null" ] || [ -z "$ACCESS_TOKEN" ]; then | |
| echo "Error: No access token in response" | |
| echo "Full response: $RESPONSE_BODY" | |
| exit 1 | |
| fi | |
| echo "::add-mask::$ACCESS_TOKEN" # Mask the access token in the logs | |
| echo "Successfully obtained access token" | |
| # Make API request to demonstrate access token | |
| echo "Testing API access..." | |
| curl -s https://api.tailscale.com/api/v2/tailnet/${{ inputs.tailnet }}/devices \ | |
| --header "Authorization: Bearer ${ACCESS_TOKEN}" |