action.yml

name: Setup GitHub app access key
description: Generate a valid access key for a given repo based on a GitHub app

inputs:
  app_id:
    description: GitHub application id
    required: true
  app_key:
    description: GitHub application secret key
    required: true
  repo:
    description: GitHub repo path (org/repo)
    required: true

outputs:
  access_token:
    description: GitHub access token
    value: ${{ steps.gh_app_installation.outputs.access_token }}

runs:
  using: "composite"
  steps:
    - name: Generate JWT and get installation access token
      id: gh_app_installation
      uses: actions/github-script@v7
      env:
        APP_KEY: ${{ inputs.app_key }}
        APP_ID: ${{ inputs.app_id }}
        REPO: ${{ inputs.repo }}
      with:
        script: |
          const crypto = require('crypto');

          const appKey = Buffer.from(process.env.APP_KEY.trim(), 'base64').toString('utf8');
          const appId = process.env.APP_ID.trim();
          const repo = process.env.REPO.trim();

          core.setSecret(process.env.APP_KEY);

          // Build JWT (RS256)
          const b64url = (data) =>
            Buffer.from(data).toString('base64')
              .replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');

          const now = Math.floor(Date.now() / 1000);
          const header  = b64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));
          const payload = b64url(JSON.stringify({ iss: parseInt(appId, 10), iat: now - 60, exp: now + 600 }));
          const content = `${header}.${payload}`;

          const signer = crypto.createSign('RSA-SHA256');
          signer.update(content);
          const jwt = `${content}.${b64url(signer.sign(appKey))}`;
          core.setSecret(jwt);

          const headers = {
            Authorization: `Bearer ${jwt}`,
            Accept: 'application/vnd.github+json',
            'X-GitHub-Api-Version': '2022-11-28',
          };

          // Get installation ID
          const installRes = await fetch(`https://api.github.com/repos/${repo}/installation`, { headers });
          if (!installRes.ok) {
            const body = await installRes.text();
            core.setFailed(`Failed to get installation for ${repo}: ${body}`);
            return;
          }
          const { id: installationId } = await installRes.json();

          // Exchange for access token
          const tokenRes = await fetch(
            `https://api.github.com/app/installations/${installationId}/access_tokens`,
            { method: 'POST', headers },
          );
          if (!tokenRes.ok) {
            const body = await tokenRes.text();
            core.setFailed(`Failed to get access token: ${body}`);
            return;
          }
          const { token } = await tokenRes.json();

          core.setSecret(token);
          core.setOutput('access_token', token);