fix push-to-action: use CLI direct invocation for token acquisition

the inline `node -e` + `TOKEN=$(...)` approach broke because
`core.getIDToken()` in @actions/core writes `::debug::` and
`::add-mask::` to stdout, polluting the captured value.

`node cli.ts gha token` uses `core.setOutput()` which writes to
the $GITHUB_OUTPUT file instead of stdout.

Made-with: Cursor

get-installation-token/action.yml

@@ -13,8 +13,8 @@ outputs:
 
 runs:
   using: "node24"
-  main: "entry"
-  post: "entry"
+  main: "entry.ts"
+  post: "post.ts"
 
 branding:
   icon: "key"

get-installation-token/entry.ts

@@ -1,69 +1,5 @@
-#!/usr/bin/env node
+import { runPullfrogCli } from "../runCli.ts";
 
-/**
- * entry point for get-installation-token action.
- * handles both main and post execution using the isPost state pattern.
- */
-
-import * as core from "@actions/core";
-import { acquireInstallationToken, revokeInstallationToken } from "../utils/token.ts";
-
-const STATE_TOKEN = "token";
-const STATE_IS_POST = "isPost";
-
-async function main(): Promise<void> {
-  core.saveState(STATE_IS_POST, "true");
-
-  const reposInput = core.getInput("repos");
-  const additionalRepos = reposInput
-    ? reposInput
-        .split(",")
-        .map((r) => r.trim())
-        .filter(Boolean)
-    : [];
-
-  const token = await acquireInstallationToken({ repos: additionalRepos });
-
-  // mask the token in logs
-  core.setSecret(token);
-
-  // save token to state for post cleanup
-  core.saveState(STATE_TOKEN, token);
-
-  // set as output
-  core.setOutput("token", token);
-
-  const scope = additionalRepos.length
-    ? `current repo + ${additionalRepos.join(", ")}`
-    : "current repo only";
-  core.info(`» installation token acquired (${scope})`);
-}
-
-async function post(): Promise<void> {
-  const token = core.getState(STATE_TOKEN);
-
-  if (!token) {
-    core.debug("no token found in state, skipping revocation");
-    return;
-  }
-
-  await revokeInstallationToken(token);
-  core.info("» installation token revoked");
-}
-
-async function run(): Promise<void> {
-  try {
-    const isPost = core.getState(STATE_IS_POST) === "true";
-
-    if (isPost) {
-      await post();
-    } else {
-      await main();
-    }
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    core.setFailed(message);
-  }
-}
-
-await run();
+runPullfrogCli({
+  cliArgs: ["gha", "token"],
+});

get-installation-token/post.ts

@@ -0,0 +1,6 @@
+import { runPullfrogCli } from "../runCli.ts";
+
+runPullfrogCli({
+  cliArgs: ["gha", "token", "--post"],
+  swallowErrors: true,
+});