feat: integrate OIDC token exchange in GitHub Action

- Add setupGitHubInstallationToken utility for OIDC token generation - Implement automatic token exchange with Pullfrog API endpoint - Add support for multiple authentication methods (input, env, OIDC) - Create setup utilities for test repository management - Update action entry point to handle new token flow - Add environment variable documentation for API key - Remove large bundled dependencies and optimize build - Support both development and production token workflows
2025-09-10 00:30:45 -07:00
parent c5b9c7cfc4
commit 3139f541e4
14 changed files with 719 additions and 26533 deletions
@@ -1,59 +1,36 @@
 import { execSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { config, parse } from "dotenv";
+import { config } from "dotenv";
+import { buildAction, setupTestRepo } from "./setup";

 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);

+// Environment variables that should be passed as secrets to the workflow
+const ENV_VARS = ["ANTHROPIC_API_KEY", "GITHUB_INSTALLATION_TOKEN"];
+
 export function runAct(prompt: string): void {
-  // First, ensure the scratch repo is cloned
  const tempDir = join(__dirname, "..", ".temp");
-
-  // Check if .temp exists and either reset it or clone it
-  if (existsSync(tempDir)) {
-    console.log("📦 Resetting existing .temp repository...");
-    execSync("git reset --hard HEAD && git clean -fd", {
-      cwd: tempDir,
-      stdio: "inherit",
-    });
-  } else {
-    console.log("📦 Cloning pullfrogai/scratch into .temp...");
-    const repoUrl = "git@github.com:pullfrogai/scratch.git";
-    execSync(`git clone ${repoUrl} ${tempDir}`, { stdio: "inherit" });
-  }
-
-  const workflowPath = join(tempDir, ".github", "workflows", "pullfrog.yml");
+  const actionPath = join(__dirname, "..");
  const envPath = join(__dirname, "..", "..", ".env");

-  // Load environment variables into process
+  // Setup test repository
+  setupTestRepo({ tempDir });
+
+  // Load environment variables
  config({ path: envPath });

-  // Parse environment variables from .env file to get keys
-  let envVars: string[] = [];
-  try {
-    const content = readFileSync(envPath, "utf8");
-    const parsed = parse(content);
-    envVars = Object.keys(parsed);
-  } catch (error) {
-    console.warn(
-      `Warning: Could not read .env file: ${(error as Error).message}`,
-    );
-  }
+  // Build action bundles
+  buildAction(actionPath);

-  // Build fresh bundles with esbuild
-  const actionPath = join(__dirname, "..");
-  console.log("🔨 Building fresh bundles with esbuild...");
-  execSync("node esbuild.config.js", {
-    cwd: actionPath,
-    stdio: "inherit",
-  });
+  const workflowPath = join(tempDir, ".github", "workflows", "pullfrog.yml");

  // Create minimal dist for act (avoids pnpm symlink issues)
  const distPath = join(actionPath, ".act-dist");
  console.log("📦 Creating minimal distribution for act...");
-  execSync(`rm -rf "${distPath}" && mkdir -p "${distPath}"`, { shell: true });
+  execSync(`rm -rf "${distPath}" && mkdir -p "${distPath}"`, { shell: "/bin/bash" });

  // Copy only necessary files (bundled, no node_modules needed)
  ["action.yml", "entry.cjs", "index.cjs", "package.json"].forEach((file) => {
@@ -79,11 +56,15 @@ export function runAct(prompt: string): void {
      `pullfrog/action@v0=${distPath}`, // Use minimal dist without symlinks
    ];

-    // Add all environment variables as secrets (without values)
-    envVars.forEach((key) => {
-      actCommandParts.push("-s", key);
+    // Add environment variables as secrets that will be available to the workflow
+    ENV_VARS.forEach((key) => {
+      if (process.env[key]) {
+        actCommandParts.push("-s", key);
+      }
    });

+    // We only need the specific ENV_VARS, no need to add other variables
+
    const actCommand = actCommandParts.join(" ");

    console.log("🚀 Running act with prompt:");
@@ -0,0 +1,56 @@
+import * as core from "@actions/core";
+
+/**
+ * Setup GitHub installation token for the action
+ */
+export async function setupGitHubInstallationToken(): Promise<string> {
+  // Check if we have an installation token from inputs or environment
+  const inputToken = core.getInput("github_installation_token");
+  const envToken = process.env.GITHUB_INSTALLATION_TOKEN;
+  
+  const existingToken = inputToken || envToken;
+  if (existingToken) {
+    core.info("Using provided GitHub installation token");
+    return existingToken;
+  }
+
+  core.info("No cached installation token found, generating OIDC token...");
+
+  try {
+    // Generate OIDC token for our API
+    const oidcToken = await core.getIDToken("pullfrog-api");
+    core.info("OIDC token generated successfully");
+
+    // Exchange OIDC token for installation token
+    const apiUrl = process.env.API_URL || "https://pullfrog.ai";
+
+    const tokenResponse = await fetch(`${apiUrl}/api/github/installation-token`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${oidcToken}`,
+        "Content-Type": "application/json",
+      },
+    });
+
+    if (!tokenResponse.ok) {
+      const errorText = await tokenResponse.text();
+      throw new Error(
+        `Token exchange failed: ${tokenResponse.status} ${tokenResponse.statusText} - ${errorText}`
+      );
+    }
+
+    const tokenData = await tokenResponse.json();
+    core.info(
+      `Installation token obtained for ${tokenData.owner}/${tokenData.repository || "all repositories"}`
+    );
+
+    // Set the token as an environment variable for this run
+    process.env.GITHUB_INSTALLATION_TOKEN = tokenData.token;
+
+    return tokenData.token;
+  } catch (error) {
+    throw new Error(
+      `Failed to setup GitHub installation token: ${error instanceof Error ? error.message : "Unknown error"}`
+    );
+  }
+}
@@ -1,3 +1,5 @@
 export * from "./files";
+export * from "./github";
+export * from "./setup";
 export * from "./subprocess";
 export * from "./table";
@@ -0,0 +1,51 @@
+import { execSync } from "node:child_process";
+import { existsSync, rmSync } from "node:fs";
+
+export interface SetupOptions {
+  tempDir: string;
+  repoUrl?: string;
+  forceClean?: boolean;
+}
+
+/**
+ * Setup the test repository for running actions
+ */
+export function setupTestRepo(options: SetupOptions): void {
+  const {
+    tempDir,
+    repoUrl = "git@github.com:pullfrogai/scratch.git",
+    forceClean = false,
+  } = options;
+
+  // Handle existing temp directory
+  if (existsSync(tempDir)) {
+    if (forceClean) {
+      console.log("🗑️  Removing existing .temp directory...");
+      rmSync(tempDir, { recursive: true, force: true });
+
+      // Clone the repository
+      console.log("📦 Cloning pullfrogai/scratch into .temp...");
+      execSync(`git clone ${repoUrl} ${tempDir}`, { stdio: "inherit" });
+    } else {
+      console.log("📦 Resetting existing .temp repository...");
+      execSync("git reset --hard HEAD && git clean -fd", {
+        cwd: tempDir,
+        stdio: "inherit",
+      });
+    }
+  } else {
+    console.log("📦 Cloning pullfrogai/scratch into .temp...");
+    execSync(`git clone ${repoUrl} ${tempDir}`, { stdio: "inherit" });
+  }
+}
+
+/**
+ * Build the action bundles
+ */
+export function buildAction(actionPath: string): void {
+  console.log("🔨 Building fresh bundles with esbuild...");
+  execSync("node esbuild.config.js", {
+    cwd: actionPath,
+    stdio: "inherit",
+  });
+}