Initial commit

src/github/token.ts

@@ -0,0 +1,123 @@
+#!/usr/bin/env bun
+
+import * as core from "@actions/core";
+
+type RetryOptions = {
+  maxAttempts?: number;
+  initialDelayMs?: number;
+  maxDelayMs?: number;
+  backoffFactor?: number;
+};
+
+async function retryWithBackoff<T>(
+  operation: () => Promise<T>,
+  options: RetryOptions = {},
+): Promise<T> {
+  const {
+    maxAttempts = 3,
+    initialDelayMs = 5000,
+    maxDelayMs = 20000,
+    backoffFactor = 2,
+  } = options;
+
+  let delayMs = initialDelayMs;
+  let lastError: Error | undefined;
+
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    try {
+      console.log(`Attempt ${attempt} of ${maxAttempts}...`);
+      return await operation();
+    } catch (error) {
+      lastError = error instanceof Error ? error : new Error(String(error));
+      console.error(`Attempt ${attempt} failed:`, lastError.message);
+
+      if (attempt < maxAttempts) {
+        console.log(`Retrying in ${delayMs / 1000} seconds...`);
+        await new Promise((resolve) => setTimeout(resolve, delayMs));
+        delayMs = Math.min(delayMs * backoffFactor, maxDelayMs);
+      }
+    }
+  }
+
+  throw new Error(
+    `Operation failed after ${maxAttempts} attempts. Last error: ${
+      lastError?.message ?? "Unknown error"
+    }`,
+  );
+}
+
+async function getOidcToken(): Promise<string> {
+  try {
+    const oidcToken = await core.getIDToken("claude-code-github-action");
+
+    if (!oidcToken) {
+      throw new Error("OIDC token not found");
+    }
+
+    return oidcToken;
+  } catch (error) {
+    throw new Error(
+      `Failed to get OIDC token: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+}
+
+async function exchangeForAppToken(oidcToken: string): Promise<string> {
+  const response = await fetch(
+    "https://api.anthropic.com/api/github/github-app-token-exchange",
+    {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${oidcToken}`,
+      },
+    },
+  );
+
+  if (!response.ok) {
+    throw new Error(
+      `App token exchange failed: ${response.status} ${response.statusText}`,
+    );
+  }
+
+  const appTokenData = (await response.json()) as {
+    token?: string;
+    app_token?: string;
+  };
+  const appToken = appTokenData.token || appTokenData.app_token;
+
+  if (!appToken) {
+    throw new Error("App token not found in response");
+  }
+
+  return appToken;
+}
+
+export async function setupGitHubToken(): Promise<string> {
+  try {
+    // Check if GitHub token was provided as override
+    const providedToken = process.env.OVERRIDE_GITHUB_TOKEN;
+
+    if (providedToken) {
+      console.log("Using provided GITHUB_TOKEN for authentication");
+      core.setOutput("GITHUB_TOKEN", providedToken);
+      return providedToken;
+    }
+
+    console.log("Requesting OIDC token...");
+    const oidcToken = await retryWithBackoff(() => getOidcToken());
+    console.log("OIDC token successfully obtained");
+
+    console.log("Exchanging OIDC token for app token...");
+    const appToken = await retryWithBackoff(() =>
+      exchangeForAppToken(oidcToken),
+    );
+    console.log("App token successfully obtained");
+
+    console.log("Using GITHUB_TOKEN from OIDC");
+    core.setOutput("GITHUB_TOKEN", appToken);
+    return appToken;
+  } catch (error) {
+    core.setFailed(`Failed to setup GitHub token: ${error}`);
+    process.exit(1);
+  }
+}