Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions action/dist/index.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion action/dist/index.js.map

Large diffs are not rendered by default.

6 changes: 3 additions & 3 deletions action/src/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -35,15 +35,15 @@ const stepRegex = requireEnv("INPUT_STEP_REGEX");

const workerUrl = requireEnv("INPUT_WORKER_URL");

// ── Authentication ──────────────────────────────────────────────────────────
// Authentication
// Exchange a GitHub OIDC token for an installation access token via the
// Cloudflare Worker. Requires id-token: write on the job.

const installationToken = await getInstallationTokenFromWorker(workerUrl);
const octokit = new Octokit({ auth: installationToken });
const gql = graphql.defaults({ headers: { authorization: `token ${installationToken}` } });

// ── Job log processing ──────────────────────────────────────────────────────
// Job log processing

interface Row {
url: string;
Expand Down Expand Up @@ -294,7 +294,7 @@ async function unminimizeIfHidden(nodeId: string): Promise<void> {
);
}

// ── Worker authentication helper ────────────────────────────────────────────
// Worker authentication helper

async function getInstallationTokenFromWorker(workerUrl: string): Promise<string> {
const tokenRequestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
Expand Down
16 changes: 8 additions & 8 deletions worker/src/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ export default {
};

async function handleTokenRequest(request: Request, env: Env): Promise<Response> {
// ── 1. Extract OIDC token ──────────────────────────────────────────────────
// 1. Extract OIDC token
const authHeader = request.headers.get("Authorization");
if (!authHeader?.startsWith("Bearer ")) {
return jsonError(
Expand All @@ -48,7 +48,7 @@ async function handleTokenRequest(request: Request, env: Env): Promise<Response>
}
const oidcToken = authHeader.slice("Bearer ".length);

// ── 2. Verify GitHub OIDC token ───────────────────────────────────────────
// 2. Verify GitHub OIDC token
// The expected audience is the URL of this worker itself.
// The GitHub Action must request its OIDC token with this URL as the audience.
const workerOrigin = new URL(request.url).origin;
Expand All @@ -70,7 +70,7 @@ async function handleTokenRequest(request: Request, env: Env): Promise<Response>
const owner = repository.slice(0, slashIdx);
const repo = repository.slice(slashIdx + 1);

// ── 3. Create GitHub App JWT ───────────────────────────────────────────────
// 3. Create GitHub App JWT
let appJwt: string;
try {
appJwt = await createAppJwt(env.GITHUB_APP_PRIVATE_KEY, env.GITHUB_APP_ID);
Expand All @@ -79,7 +79,7 @@ async function handleTokenRequest(request: Request, env: Env): Promise<Response>
return jsonError("Internal error: failed to create App JWT", 500);
}

// ── 4. Look up the App installation for this repository ───────────────────
// 4. Look up the App installation for this repository
let installationId: number;
try {
installationId = await getInstallationId(appJwt, owner, repo);
Expand All @@ -96,7 +96,7 @@ async function handleTokenRequest(request: Request, env: Env): Promise<Response>
return jsonError("Failed to look up GitHub App installation", 500);
}

// ── 5. Create an installation access token ────────────────────────────────
// 5. Create an installation access token
let tokenData: { token: string; expires_at: string };
try {
tokenData = await createInstallationToken(appJwt, installationId);
Expand All @@ -113,7 +113,7 @@ async function handleTokenRequest(request: Request, env: Env): Promise<Response>
});
}

// ── GitHub OIDC helpers ────────────────────────────────────────────────────────
// GitHub OIDC helpers

/**
* Verify a GitHub Actions OIDC JWT.
Expand All @@ -137,7 +137,7 @@ async function verifyGitHubOIDCToken(
return payload as Record<string, unknown>;
}

// ── GitHub App JWT helpers ─────────────────────────────────────────────────────
// GitHub App JWT helpers

/**
* Create a short-lived GitHub App JWT for authenticating App-level API calls.
Expand Down Expand Up @@ -215,7 +215,7 @@ async function createInstallationToken(
return (await response.json()) as { token: string; expires_at: string };
}

// ── Utility ────────────────────────────────────────────────────────────────────
// Utility

function jsonError(message: string, status: number): Response {
return Response.json({ error: message }, { status });
Expand Down
Loading