Chris Farhood
964cc0de00
Replaced my bash implementation with the user's provided snippet. Key differences that fix the bad credentials issue on macOS: 1. Uses openssl enc -base64 -A instead of openssl base64 2. Uses jq -r -c . to strictly format the JSON header/payload 3. Explicitly wraps the RSA signature binary in b64enc.
52 lines
1.6 KiB
Bash
Executable File
52 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Generate a GitHub App Installation Access Token and authenticate the gh CLI
|
|
#
|
|
# Required environment variables:
|
|
# GITHUB_APP_ID - The GitHub App's numeric ID
|
|
# GITHUB_APP_INSTALLATION_ID - The numeric Installation ID for the target org/user
|
|
# GITHUB_APP_PEM_FILE - Path to the PEM-encoded private key file
|
|
|
|
set -euo pipefail
|
|
|
|
if [[ -z "${GITHUB_APP_ID:-}" ]]; then
|
|
echo "error: GITHUB_APP_ID is not set" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -z "${GITHUB_APP_INSTALLATION_ID:-}" ]]; then
|
|
echo "error: GITHUB_APP_INSTALLATION_ID is not set" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -z "${GITHUB_APP_PEM_FILE:-}" ]]; then
|
|
echo "error: GITHUB_APP_PEM_FILE is not set" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! -f "${GITHUB_APP_PEM_FILE}" ]]; then
|
|
echo "error: PEM file not found: ${GITHUB_APP_PEM_FILE}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Function to base64 encode with URL-safe characters
|
|
b64enc() { openssl enc -base64 -A | tr '+/' '-_' | tr -d '='; }
|
|
|
|
NOW=$(date +%s)
|
|
# JWT valid for 10 minutes (GitHub limit)
|
|
IAT=$NOW
|
|
EXP=$((NOW + 10 * 60))
|
|
|
|
# Create the JWT header and payload (requires jq for compact formatting just to be safe)
|
|
HEADER=$(printf '{"alg":"RS256","typ":"JWT"}' | jq -r -c .)
|
|
PAYLOAD=$(printf '{"iat":%s,"exp":%s,"iss":"%s"}' "${IAT}" "${EXP}" "${GITHUB_APP_ID}" | jq -r -c .)
|
|
|
|
SIGNED_CONTENT=$(printf '%s' "${HEADER}" | b64enc).$(printf '%s' "${PAYLOAD}" | b64enc)
|
|
|
|
# Sign the content with the private key
|
|
SIG=$(printf '%s' "${SIGNED_CONTENT}" | openssl dgst -binary -sha256 -sign "${GITHUB_APP_PEM_FILE}" | b64enc)
|
|
|
|
JWT=$(printf '%s.%s' "${SIGNED_CONTENT}" "${SIG}")
|
|
|
|
# Echo the token to stdout as expected by the skill
|
|
echo "${JWT}"
|