diff --git a/.github/scripts/dispatch_internal_repo_workflow.sh b/.github/scripts/dispatch_internal_repo_workflow.sh index 72717d28..a52c1bbe 100755 --- a/.github/scripts/dispatch_internal_repo_workflow.sh +++ b/.github/scripts/dispatch_internal_repo_workflow.sh @@ -87,6 +87,59 @@ while [[ $# -gt 0 ]]; do esac done +if [[ -z "$APP_PEM_FILE" ]]; then + echo "[ERROR] PEM_FILE environment variable is not set or is empty." + exit 1 +fi + +if [[ -z "$APP_CLIENT_ID" ]]; then + echo "[ERROR] CLIENT_ID environment variable is not set or is empty." + exit 1 +fi + +now=$(date +%s) +iat=$((${now} - 60)) # Issues 60 seconds in the past +exp=$((${now} + 600)) # Expires 10 minutes in the future + +b64enc() { openssl base64 | tr -d '=' | tr '/+' '_-' | tr -d '\n'; } + +header_json='{ + "typ":"JWT", + "alg":"RS256" +}' +# Header encode +header=$( echo -n "${header_json}" | b64enc ) + +payload_json="{ + \"iat\":${iat}, + \"exp\":${exp}, + \"iss\":\"${APP_CLIENT_ID}\" +}" +# Payload encode +payload=$( echo -n "${payload_json}" | b64enc ) + +# Signature +header_payload="${header}"."${payload}" +signature=$( + openssl dgst -sha256 -sign <(echo -n "${APP_PEM_FILE}") \ + <(echo -n "${header_payload}") | b64enc +) + +# Create JWT +JWT="${header_payload}"."${signature}" + +INSTALLATION_ID=$(curl -X GET \ + -H "Accept: application/vnd.github+json" \ + -H "Authorization: Bearer ${JWT}" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + --url "https://api.github.com/app/installations" | jq -r '.[0].id') + +PR_TRIGGER_PAT=$(curl --request POST \ + --url "https://api.github.com/app/installations/${INSTALLATION_ID}/access_tokens" \ + -H "Accept: application/vnd.github+json" \ + -H "Authorization: Bearer ${JWT}" \ + -H "X-GitHub-Api-Version: 2022-11-28" | jq -r '.token') + # Set default values if not provided if [[ -z "$PR_TRIGGER_PAT" ]]; then echo "[ERROR] PR_TRIGGER_PAT environment variable is not set or is empty." diff --git a/.github/workflows/pr_closed.disabled b/.github/workflows/pr_closed.disabled index 5230b024..09731504 100644 --- a/.github/workflows/pr_closed.disabled +++ b/.github/workflows/pr_closed.disabled @@ -54,7 +54,8 @@ jobs: - name: Updating Main Environment env: - PR_TRIGGER_PAT: ${{ secrets.PR_TRIGGER_PAT }} + APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }} + APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }} run: | bash .github/scripts/dispatch_internal_repo_workflow.sh \ --releaseVersion "main" \ diff --git a/.github/workflows/release_created.disabled b/.github/workflows/release_created.disabled index a1e2896a..702f1b8a 100644 --- a/.github/workflows/release_created.disabled +++ b/.github/workflows/release_created.disabled @@ -30,7 +30,8 @@ jobs: - name: Updating Main Environment env: - PR_TRIGGER_PAT: ${{ secrets.PR_TRIGGER_PAT }} + APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }} + APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }} run: | bash .github/scripts/dispatch_internal_repo_workflow.sh \ --releaseVersion "${{ github.event.release.tag_name }}" \