hanzoai/docker-github-actions-runner
2
0
Fork 0
mirror of https://github.com/hanzoai/docker-github-actions-runner.git synced 2026-09-30 21:42:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow to put APP_PRIVATE_KEY in Docker env file. Introduced APP_LOGIN to fix access token retrieval in case of multiple GitHub's App subscriber.

Browse Source
This commit is contained in:
Abramo Bagnara
2022-12-06 08:50:29 +01:00
parent d54b9126fd
commit 0d5e2807ea
2 changed files with 14 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app_token.sh
+4 -3
View File
@@ -4,6 +4,7 @@
# Environment variable that need to be set up:
# * APP_ID, the GitHub's app ID
# * APP_PRIVATE_KEY, the content of GitHub app's private key in PEM format.
# * APP_LOGIN, the login name used to install GitHub's app
#
# https://github.com/orgs/community/discussions/24743#discussioncomment-3245300
#
@@ -66,7 +67,7 @@ rs256_sign() {
request_access_token() {
jwt_payload=$(build_jwt_payload)
encoded_jwt_parts=$(base64url <<<"${JWT_JOSE_HEADER}").$(base64url <<<"${jwt_payload}")
encoded_mac=$(echo -n "$encoded_jwt_parts" | rs256_sign "${APP_PRIVATE_KEY}" | base64url)
encoded_mac=$(echo -n "${encoded_jwt_parts}" | rs256_sign "${APP_PRIVATE_KEY}" | base64url)
generated_jwt="${encoded_jwt_parts}.${encoded_mac}"
auth_header="Authorization: Bearer ${generated_jwt}"
@@ -74,9 +75,9 @@ request_access_token() {
app_installations_response=$(curl -sX GET \
-H "${auth_header}" \
-H "${API_HEADER}" \
${APP_INSTALLATIONS_URI} \
"${APP_INSTALLATIONS_URI}" \
)
access_token_url=$(echo "$app_installations_response" | jq --raw-output '.[] | select (.app_id == '"${APP_ID}"') .access_tokens_url')
access_token_url=$(echo "${app_installations_response}" | jq --raw-output '.[] | select (.account.login == "'"${APP_LOGIN}"'" and .app_id == '"${APP_ID}"') .access_tokens_url')
curl -sX POST \
-H "${CONTENT_LENGTH_HEADER}" \
-H "${auth_header}" \
entrypoint.sh
+10 -8
View File
@@ -2,7 +2,7 @@
# shellcheck shell=bash
export RUNNER_ALLOW_RUNASROOT=1
export PATH=$PATH:/actions-runner
export PATH=${PATH}:/actions-runner
# Un-export these, so that they must be passed explicitly to the environment of
# any command that needs them. This may help prevent leaks.
@@ -31,7 +31,7 @@ _GITHUB_HOST=${GITHUB_HOST:="github.com"}
_RUN_AS_ROOT=${RUN_AS_ROOT:="true"}
# ensure backwards compatibility
if [[ -z $RUNNER_SCOPE ]]; then
if [[ -z ${RUNNER_SCOPE} ]]; then
if [[ ${ORG_RUNNER} == "true" ]]; then
echo 'ORG_RUNNER is now deprecated. Please use RUNNER_SCOPE="org" instead.'
export RUNNER_SCOPE="org"
@@ -64,15 +64,17 @@ esac
configure_runner() {
ARGS=()
if [[ -n "${APP_ID}" ]] && [[ -n "${APP_PRIVATE_KEY}" ]]; then
if [[ -n "${APP_ID}" ]] && [[ -n "${APP_PRIVATE_KEY}" ]] && [[ -n "${APP_LOGIN}" ]]; then
if [[ -n "${ACCESS_TOKEN}" ]] || [[ -n "${RUNNER_TOKEN}" ]]; then
echo "ERROR: ACCESS_TOKEN or RUNNER_TOKEN provided but are mutually exclusive with APP_ID and APP_PRIVATE_KEY." >&2
echo "ERROR: ACCESS_TOKEN or RUNNER_TOKEN provided but are mutually exclusive with APP_ID, APP_PRIVATE_KEY and APP_LOGIN." >&2
exit 1
fi
echo "Obtaining access token for app_id ${APP_ID}"
ACCESS_TOKEN=$(APP_ID="${APP_ID}" APP_PRIVATE_KEY="${APP_PRIVATE_KEY}" bash /app_token.sh)
elif [[ -n "${APP_ID}" ]] || [[ -n "${APP_PRIVATE_KEY}" ]]; then
echo "ERROR: Both APP_ID and APP_PRIVATE_KEY must be specified." >&2
echo "Obtaining access token for app_id ${APP_ID} and login ${APP_LOGIN}"
nl="
"
ACCESS_TOKEN=$(APP_ID="${APP_ID}" APP_PRIVATE_KEY="${APP_PRIVATE_KEY//\\n/${nl}}" APP_LOGIN="${APP_LOGIN}" bash /app_token.sh)
elif [[ -n "${APP_ID}" ]] || [[ -n "${APP_PRIVATE_KEY}" ]] || [[ -n "${APP_LOGIN}" ]]; then
echo "ERROR: All of APP_ID, APP_PRIVATE_KEY and APP_LOGIN must be specified." >&2
exit 1
fi