Skip to content

Commit 7c748d7

Browse files
eloymgzerok
eloymg
and
zerok
authored
feat(create-github-app-token): adding create-github-app-token action (#1144)
* adding create-github-app-token action * docs, release and refactor * added suggestions and improvements Co-Authored-By: Horst <[email protected]> * format fixes * revert to two tokens required and format fixes --------- Co-authored-by: Horst <[email protected]>
1 parent adc9b83 commit 7c748d7

File tree

3 files changed

+197
-1
lines changed

3 files changed

+197
-1
lines changed

‎.release-please-manifest.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,5 +20,6 @@
2020
"actions/find-pr-for-commit": "1.0.1",
2121
"actions/remove-checkout-credentials": "0.1.0",
2222
"actions/dependabot-auto-triage": "1.1.0",
23-
"actions/get-latest-workflow-artifact": "0.1.0"
23+
"actions/get-latest-workflow-artifact": "0.1.0",
24+
"actions/create-github-app-token": "v0.1.0"
2425
}

‎actions/create-github-app-token/README.md

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
# create-github-app-token
2+
3+
From a `grafana/` org repository, get a ephemeral GitHub API token from a GitHub App using Vault.
4+
5+
## Inputs
6+
7+
| Name | Type | Description | Default Value | Required |
8+
| ---------------- | ------ | --------------------------- | ------------- | -------- |
9+
| `permission_set` | String | The required permission set | `default` | Yes |
10+
| `github-app` | String | The required GitHub app | | Yes |
11+
| `vault_instance` | String | Vault instance to point | `ops` | No |
12+
13+
## Outputs
14+
15+
| Name | Type | Description |
16+
| -------------- | ------ | -------------------------- |
17+
| `github_token` | String | The generated GitHub token |
18+
19+
## Examples
20+
21+
### Using Environment Variables (default)
22+
23+
<!-- x-release-please-start-version -->
24+
25+
#### Using default permission set
26+
27+
```yaml
28+
name: CI
29+
on:
30+
pull_request:
31+
32+
jobs:
33+
build:
34+
runs-on: ubuntu-latest
35+
36+
# These permissions are needed to assume roles from GitHub's OIDC.
37+
permissions:
38+
contents: read
39+
id-token: write
40+
41+
steps:
42+
- id: get-github-token
43+
uses: grafana/shared-workflows/actions/create-github-app-token@create-github-app-token/v0.1.0
44+
with:
45+
github_app: github-app-name
46+
47+
# Use the secrets
48+
- name: list issues assignees
49+
run: |
50+
curl -L \
51+
-H "Accept: application/vnd.github+json" \
52+
-H "Authorization: Bearer ${{ steps.get-github-token.outputs.github_token }}" \
53+
-H "X-GitHub-Api-Version: 2022-11-28" \
54+
https://api.github.com/repos/grafana/grafana/assignees
55+
```
56+
57+
#### Using multiple permissions sets
58+
59+
```yaml
60+
name: CI
61+
on:
62+
pull_request:
63+
64+
jobs:
65+
build:
66+
runs-on: ubuntu-latest
67+
68+
# These permissions are needed to assume roles from GitHub's OIDC.
69+
permissions:
70+
contents: read
71+
id-token: write
72+
73+
steps:
74+
- id: get-github-token-read
75+
uses: grafana/shared-workflows/actions/create-github-app-token@create-github-app-token/v0.1.0
76+
with:
77+
github_app: github-app-name
78+
permissions-set: read-only-on-foo-repository
79+
80+
# Use the secrets
81+
- name: list issues assignees
82+
run: |
83+
curl -L \
84+
-H "Accept: application/vnd.github+json" \
85+
-H "Authorization: Bearer ${{ steps.get-github-token-read.outputs.github_token }}" \
86+
-H "X-GitHub-Api-Version: 2022-11-28" \
87+
https://api.github.com/repos/grafana/foo-repository/assignees
88+
89+
- id: get-github-token-write
90+
uses: grafana/shared-workflows/actions/create-github-app-token@create-github-app-token/v0.1.0
91+
with:
92+
github_app: github-app-name
93+
permissions-set: write-on-bar-repository
94+
95+
# Use the secrets
96+
- name: create a pull request
97+
run: |
98+
curl -L \
99+
-X POST \
100+
-H "Accept: application/vnd.github+json" \
101+
-H "Authorization: Bearer ${{ steps.get-github-token-write.outputs.github_token }}" \
102+
-H "X-GitHub-Api-Version: 2022-11-28" \
103+
https://api.github.com/repos/grafana/bar-repository/pulls \
104+
-d '{"title":"Amazing new feature","body":"Please pull these awesome changes in!","head":"octocat:new-feature","base":"master"}'
105+
```
106+
107+
<!-- x-release-please-end-version -->

‎actions/create-github-app-token/action.yaml

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: Create GitHub App Token
2+
description: Composite action (step) to get create github app token using vault.
3+
inputs:
4+
permission_set:
5+
description: Permission set name
6+
default: default
7+
github_app:
8+
description: |
9+
GitHub app name in Vault
10+
vault_instance:
11+
description: |
12+
The Vault instance to use (`dev` or `ops`). Defaults to `ops`.
13+
default: ops
14+
outputs:
15+
token:
16+
description: "GitHub installation access token"
17+
value: ${{ steps.generate-token.outputs.github_token }}
18+
runs:
19+
using: composite
20+
steps:
21+
- id: check-vault-instance
22+
if: inputs.vault_instance != 'dev' && inputs.vault_instance != 'ops'
23+
shell: bash
24+
env:
25+
VAULT_INSTANCE: ${{ inputs.vault_instance }}
26+
run: |
27+
echo "Invalid value for vault_instance input: ${VAULT_INSTANCE}. Must be 'dev' or 'ops'."
28+
exit 1
29+
30+
- id: normalize-workflow-name
31+
shell: bash
32+
env:
33+
WORKFLOW_REF: ${{ github.workflow_ref }}
34+
run: |
35+
RAW_NAME="${WORKFLOW_REF}"
36+
REF_SHA=$(echo -n "$RAW_NAME" | sed -E 's|^[^/]*/[^/]*/||' | sed -E 's/@.*//' | sha256sum | awk '{print $1}')
37+
echo "ref_sha=$REF_SHA" >> "$GITHUB_OUTPUT"
38+
39+
- id: get-github-jwt-token
40+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
41+
env:
42+
VAULT_INSTANCE: ${{ inputs.vault_instance }}
43+
with:
44+
script: |
45+
const jwt = await core.getIDToken("vault-github-actions-grafana-"+process.env.VAULT_INSTANCE);
46+
core.setSecret(jwt);
47+
core.setOutput("github-jwt",jwt);
48+
49+
- id: get-github-jwt-auth-token
50+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
51+
env:
52+
VAULT_INSTANCE: ${{ inputs.vault_instance }}
53+
with:
54+
script: |
55+
const jwt = await core.getIDToken("https://vault-github-actions.grafana-"+process.env.VAULT_INSTANCE+".net");
56+
core.setSecret(jwt);
57+
core.setOutput("github-jwt",jwt);
58+
59+
- name: Authenticate with Vault
60+
id: auth-vault
61+
shell: bash
62+
env:
63+
VAULT_INSTANCE: ${{ inputs.vault_instance }}
64+
REPOSITORY_NAME: ${{ github.event.repository.name }}
65+
PERMISSION_SET: ${{ inputs.permission_set}}
66+
VAULT_URL: "https://vault-github-actions.grafana-${{ inputs.vault_instance }}.net"
67+
run: |
68+
echo "${REPOSITORY_NAME}-${{ steps.normalize-workflow-name.outputs.ref_sha }}-${PERMISSION_SET}"
69+
curl --fail -X POST "${VAULT_URL}/v1/auth/github-actions-oidc/login" \
70+
-H "Content-Type: application/json" \
71+
-H "Proxy-Authorization-Token: Bearer ${{ steps.get-github-jwt-token.outputs.github-jwt }}" \
72+
-d "{\"role\": \"${REPOSITORY_NAME}-${{ steps.normalize-workflow-name.outputs.ref_sha }}-${PERMISSION_SET}\",\"jwt\": \"${{ steps.get-github-jwt-auth-token.outputs.github-jwt }}\"}" \
73+
| jq -r '"vault_token=\(.auth.client_token)"' >> $GITHUB_OUTPUT
74+
75+
- name: Get GitHub Token
76+
id: generate-token
77+
shell: bash
78+
env:
79+
VAULT_INSTANCE: ${{ inputs.vault_instance }}
80+
REPOSITORY_NAME: ${{ github.event.repository.name }}
81+
PERMISSION_SET: ${{ inputs.permission_set}}
82+
GITHUB_APP: ${{ inputs.github_app }}
83+
VAULT_URL: "https://vault-github-actions.grafana-${{ inputs.vault_instance }}.net"
84+
run: |
85+
curl --fail "{$VAULT_URL}/v1/github-app-${GITHUB_APP}/token/${REPOSITORY_NAME}-${{ steps.normalize-workflow-name.outputs.ref_sha }}-${PERMISSION_SET}" \
86+
-H "X-Vault-Token: ${{ steps.auth-vault.outputs.vault_token }}" \
87+
-H "Proxy-Authorization-Token: Bearer ${{ steps.get-github-jwt-token.outputs.github-jwt }}" \
88+
| jq -r '"github_token=\(.data.token)"' >> $GITHUB_OUTPUT

0 commit comments

Comments
 (0)