action.yml

name: Get Github App Token
description: Retrieve a Github app installation access token from the github_app_token lambda by invoking its lambda function URL. This composite action assumes that a previous job step has already set up the necessary AWS credentials in the environment using the aws-actions/configure-aws-credentials action.
inputs:
  github-app-name:
    description: The name of the Github app that you'd like to retrieve a token for
    required: true
  partition:
    description: What partition the authorization is for
    default: 'commercial'
    type: choice
    options:
      - commercial
      - fedramp
outputs:
  app-token:
    description: The app installation access token, which you can use to authenticate your requests to Github
    value: ${{ steps.get_token.outputs.app_token }}
  expires-at:
    description: Token expiration date/time, in UTC ISO format
    value: ${{ steps.get_token.outputs.expires_at }}
  permissions:
    description: map specifying the permissions of the token - this will be the same as what you requested for your GitHub app
    value: ${{ steps.get_token.outputs.permissions }}


runs:
  using: 'composite'
  steps:
    - name: Retrieve the app token from the github_app token lambda using the function URL
      shell: bash
      id: get_token
      env:
        TEMP_DIR: ${{ runner.temp }}
        COMMERCIAL_LAMBDA_FUNCTION_URL: "https://s5mfys5te5aks7kw7p54vmbhvu0vyqlw.lambda-url.us-east-1.on.aws/"
        FEDRAMP_LAMBDA_FUNCTION_URL: "https://x4ltsnejil7dy6quaim6pn2iue0ewclt.lambda-url.us-east-1.on.aws/"
      run: |
        if [[ ${{ inputs.partition }} -eq "fedramp" ]]; then
          LAMBDA_FUNCTION_URL=$FEDRAMP_LAMBDA_FUNCTION_URL
        else
          LAMBDA_FUNCTION_URL=$COMMERCIAL_LAMBDA_FUNCTION_URL
        fi
        TOKEN_FILE="$TEMP_DIR/token.json"
        DATA='{"github_app_name":"${{ inputs.github-app-name }}"}'
        echo "DATA: $DATA"
        exit_code="$(curl \
          -v -o "$TOKEN_FILE" \
          -w "%{http_code}" \
          --aws-sigv4 aws:amz:us-east-1:lambda \
          -u "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" \
          -H "x-amz-security-token: $AWS_SESSION_TOKEN" \
          -H "content-type: application/json" \
          -d "$DATA" \
          $LAMBDA_FUNCTION_URL)"
        if [[ "$exit_code" -ge 400 ]]; then
          echo "HTTP $exit_code"
          cat "$TOKEN_FILE"
          exit 1
        fi
        jq -r '"token expires at \(.expires_at)"' "$TOKEN_FILE"
        # Mask the token value so it doesn't leak.
        # https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#masking-a-value-in-a-log
        jq -r '"::add-mask::\(.token)"' "$TOKEN_FILE"
        jq -r '"app_token=\(.token)"' "$TOKEN_FILE" >> "$GITHUB_OUTPUT"
        jq -r '"expires_at=\(.expires_at)"' "$TOKEN_FILE" >> "$GITHUB_OUTPUT"
        jq -r '"permissions=\(.permissions)"' "$TOKEN_FILE" >> "$GITHUB_OUTPUT"