Make it open

.dockerignore

@@ -0,0 +1,3 @@
+/node_modules/
+/dist/
+/Dockerfile

.eslintignore

@@ -0,0 +1,2 @@
+/dist/
+/crates/*/pkg

.eslintrc.yml

@@ -0,0 +1,20 @@
+env:
+  es2020: true
+  browser: true
+  node: true
+extends:
+  - "eslint:recommended"
+  - "plugin:@typescript-eslint/eslint-recommended"
+  - "prettier"
+parser: "@typescript-eslint/parser"
+plugins:
+  - "@typescript-eslint"
+parserOptions:
+  sourceType: module
+settings:
+  react:
+    version: detect
+rules:
+  no-unused-vars:
+    - error
+    - argsIgnorePattern: "^_"

.github/workflows/actionlint.yml

@@ -0,0 +1,19 @@
+name: actionlint
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/**"
+
+jobs:
+  actionlint:
+    name: actionlint with reviewdog
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: actionlint
+        uses: reviewdog/action-actionlint@v1.37.1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          reporter: github-pr-review

.github/workflows/check-build.yml

@@ -0,0 +1,22 @@
+name: Check & Build
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  build_img:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2.0.0
+
+      - name: Check & Build
+        uses: docker/build-push-action@v3.3.1

.gitignore

@@ -0,0 +1,5 @@
+/node_modules/
+.DS_Store
+/dist/
+/dist-ssr/
+*.local

.prettierignore

@@ -0,0 +1,5 @@
+/dist/
+/node_modules/
+/deploy/
+/crates/*/pkg
+/crates/*/target

Dockerfile

@@ -0,0 +1,15 @@
+FROM node:18-slim as builder
+
+WORKDIR /app
+COPY package.json /app
+COPY yarn.lock /app
+RUN yarn
+
+COPY . /app
+RUN yarn lint && yarn typecheck && yarn build
+
+FROM public.ecr.aws/lambda/nodejs:16
+
+COPY --from=builder /app/dist/app.js ${LAMBDA_TASK_ROOT}
+
+CMD [ "app.handler" ]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 ArkEdge Space Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1 @@
+# gh-federation

action.yml

@@ -0,0 +1,38 @@
+name: "gh-federation"
+description: "git clone other repo in the federation"
+author: "@KOBA789"
+
+inputs:
+  endpoint:
+    description: gh-federation lambda endpoint
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - uses: actions/github-script@v6
+      env:
+        GH_FEDERATION_ENDPOINT: ${{ inputs.endpoint }}
+      with:
+        script: |
+          const idToken = await core.getIDToken();
+          const hook = (request, route) => {
+            const endpoint = request.endpoint.merge(route);
+            endpoint.headers.authorization = `Bearer ${idToken}`;
+            return request(endpoint);
+          };
+          const { data } = await github.request("POST /token", {
+            baseUrl: process.env["GH_FEDERATION_ENDPOINT"],
+            request: { hook },
+          });
+          const accessToken = data["token"];
+          core.setSecret(accessToken);
+          core.exportVariable("GH_FEDERATION_ACCESS_TOKEN", accessToken);
+
+    - name: Store access token
+      shell: bash
+      run: |
+        git config --global --replace-all credential.helper ''
+        git config --global --add credential.helper store
+        echo $'protocol=https\nhost=github.com\nusername=x-access-token\npassword='"${GH_FEDERATION_ACCESS_TOKEN}"$'\n' | \
+          git credential-store store

fixtures/example.json

@@ -0,0 +1,11 @@
+{
+  "requestContext": {
+    "authorizer": {
+      "jwt": {
+        "claims": {
+          "sub": "repo:arkedge/nanika"
+        }
+      }
+    }
+  }
+}

package.json

@@ -0,0 +1,37 @@
+{
+  "name": "gh-federation",
+  "version": "1.0.0",
+  "repository": "git@github.com:arkedge/gh-federation.git",
+  "author": "Hidekazu Kobayashi <koba789@arkedgespace.com>",
+  "license": "MIT",
+  "scripts": {
+    "build:vite": "esbuild src/index.ts --bundle --format=cjs --platform=node --outfile=dist/app.js",
+    "build": "run-s build:vite",
+    "dev:esbuild": "yarn build:vite -- --watch",
+    "dev:lambda": "aws-lambda-rie npx aws-lambda-ric dist/app.handler",
+    "dev": "run-p dev:*",
+    "typecheck": "tsc",
+    "lint:prettier": "prettier . --check",
+    "lint:eslint": "eslint . --format stylish",
+    "lint": "run-p lint:*",
+    "fix:prettier": "yarn lint:prettier --write",
+    "fix:eslint": "yarn lint:eslint --fix",
+    "fix": "run-s fix:eslint fix:prettier"
+  },
+  "devDependencies": {
+    "@types/aws-lambda": "^8.10.106",
+    "@types/node": "^18.7.23",
+    "@typescript-eslint/eslint-plugin": "5.60.0",
+    "@typescript-eslint/parser": "5.60.0",
+    "esbuild": "^0.18.0",
+    "eslint": "8.43.0",
+    "eslint-config-prettier": "8.8.0",
+    "npm-run-all": "4.1.5",
+    "prettier": "2.8.8",
+    "typescript": "4.9.5"
+  },
+  "dependencies": {
+    "@aws-sdk/client-secrets-manager": "^3.180.0",
+    "@octokit/auth-app": "^4.0.5"
+  }
+}

renovate.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:base"]
+}

src/index.ts

@@ -0,0 +1,68 @@
+import type { APIGatewayProxyHandlerV2WithJWTAuthorizer } from "aws-lambda";
+
+import {
+  GetSecretValueCommand,
+  SecretsManagerClient,
+} from "@aws-sdk/client-secrets-manager";
+import { createAppAuth } from "@octokit/auth-app";
+import { authorize } from "./policy";
+
+function env(name: string): string {
+  if (Object.hasOwn(process.env, name)) {
+    return process.env[name]!;
+  } else {
+    throw new Error(`environment variable ${name} is not present`);
+  }
+}
+
+const APP_SECRET_ID = env("APP_SECRET_ID");
+const GITHUB_APP_ID = env("GITHUB_APP_ID");
+const GITHUB_APP_INSTALLATION_ID = env("GITHUB_APP_INSTALLATION_ID");
+const AWS_REGION = env("AWS_REGION");
+
+const secretmanager = new SecretsManagerClient({
+  region: AWS_REGION,
+});
+
+type AppSecret = {
+  privateKey: string;
+};
+
+async function getAppSecret(secretId: string): Promise<AppSecret> {
+  const data = await secretmanager.send(
+    new GetSecretValueCommand({
+      SecretId: secretId,
+    })
+  );
+  const secretString = data.SecretString!;
+  return JSON.parse(secretString);
+}
+
+const handler: APIGatewayProxyHandlerV2WithJWTAuthorizer = async (event) => {
+  const claims = event.requestContext.authorizer.jwt.claims;
+  if (!authorize(claims)) {
+    return { statusCode: 401 };
+  }
+
+  const { privateKey } = await getAppSecret(APP_SECRET_ID);
+
+  const auth = createAppAuth({
+    appId: GITHUB_APP_ID,
+    privateKey,
+  });
+
+  const installationAuthentication = await auth({
+    type: "installation",
+    installationId: GITHUB_APP_INSTALLATION_ID,
+  });
+
+  return {
+    statusCode: 200,
+    headers: {
+      "content-type": "application/json",
+    },
+    body: JSON.stringify(installationAuthentication),
+  };
+};
+
+exports.handler = handler;

src/policy.ts

@@ -0,0 +1,5 @@
+export type Claims = { [name: string]: string | number | boolean | string[] };
+
+export function authorize(_claims: Claims): boolean {
+  return false;
+}

tsconfig.json

@@ -0,0 +1,19 @@
+{
+  "compilerOptions": {
+    "baseUrl": "./",
+    "target": "ESNext",
+    "lib": ["ESNext"],
+    "types": ["@types/node"],
+    "allowJs": false,
+    "skipLibCheck": false,
+    "esModuleInterop": false,
+    "allowSyntheticDefaultImports": true,
+    "strict": true,
+    "forceConsistentCasingInFileNames": true,
+    "module": "ESNext",
+    "moduleResolution": "Node",
+    "resolveJsonModule": true,
+    "noEmit": true
+  },
+  "include": ["./src"]
+}