@effected/github 0.22.0 → 0.23.0

package/ActionsOidc.js

@@ -1,4 +1,4 @@
-import { JwksResolver, Jwt, JwtError } from "@effected/jwt";
+import { Oidc } from "@effected/oidc";
 import { Effect, Schema, SchemaTransformation } from "effect";
 
 // src/ActionsOidc.ts
@@ -23,6 +23,10 @@ const IdFromString = Schema.String.check(Schema.isPattern(/^\d+$/)).pipe(Schema.
 *
 * Claims GitHub adds that are not modelled here are dropped on decode.
 *
+* To decode a payload as it arrives in the token (snake_case keys, string
+* ids), use {@link ActionsOidcClaimsFromWire}; this class itself decodes the
+* camelCase form.
+*
 * @public
 */
 var ActionsOidcClaims = class extends Schema.Class("ActionsOidcClaims")({
@@ -71,8 +75,28 @@ var ActionsOidcClaims = class extends Schema.Class("ActionsOidcClaims")({
 	/** `github-hosted` or `self-hosted` (wire key `runner_environment`). */
 	runnerEnvironment: Schema.String
 }) {};
-/** The claims as they arrive in the token: snake_case keys, decoding to {@link ActionsOidcClaims}. */
-const ClaimsFromWire = ActionsOidcClaims.pipe(Schema.encodeKeys({
+/**
+* {@link ActionsOidcClaims} as the claims arrive in the token: snake_case
+* keys and string ids, decoding to the class and encoding back to the wire.
+*
+* @remarks
+* The codec {@link ActionsOidc.verify} decodes a verified payload with.
+* Exported for reading a token this process already trusts, such as one the
+* runner's own token service just issued, and for building one: encoding an
+* instance yields the exact payload GitHub would sign.
+*
+* @example
+* ```ts
+* import { ActionsOidcClaimsFromWire } from "@effected/github";
+* import { Oidc } from "@effected/oidc";
+*
+* // Unverified: only for a token handed over by a trusted runtime.
+* const read = (token: string) => Oidc.decodeUnverified(token, ActionsOidcClaimsFromWire);
+* ```
+*
+* @public
+*/
+const ActionsOidcClaimsFromWire = ActionsOidcClaims.pipe(Schema.encodeKeys({
 	repositoryId: "repository_id",
 	repositoryOwner: "repository_owner",
 	repositoryOwnerId: "repository_owner_id",
@@ -85,16 +109,11 @@ const ClaimsFromWire = ActionsOidcClaims.pipe(Schema.encodeKeys({
 	runnerEnvironment: "runner_environment"
 }));
 const verify = Effect.fn("ActionsOidc.verify")(function* (token, options) {
-	if (options.audience.length === 0) return yield* new JwtError({
-		reason: "wrongAudience",
-		detail: "no audience was given; an Actions OIDC token is never verified without one"
-	});
-	return yield* Jwt.verify(token, {
-		key: JwksResolver.forIssuer(ISSUER),
-		claims: ClaimsFromWire,
+	return yield* Oidc.verify(token, {
 		issuer: ISSUER,
 		audience: options.audience,
-		...options.clockTolerance !== void 0 ? { clockTolerance: options.clockTolerance } : {}
+		claims: ActionsOidcClaimsFromWire,
+		clockTolerance: options.clockTolerance
 	});
 });
 const testClaims = (overrides = {}) => ({
@@ -122,8 +141,9 @@ const testClaims = (overrides = {}) => ({
 * repository, workflow and run it is.
 *
 * @remarks
-* {@link ActionsOidc.verify} checks the signature against GitHub's published
-* JWKS (through `@effected/jwt`'s `JwksResolver`, which caches it), then `iss`,
+* {@link ActionsOidc.verify} is `@effected/oidc`'s `Oidc.verify` pinned to the
+* Actions issuer: it checks the signature against GitHub's published JWKS
+* (through `@effected/jwt`'s `JwksResolver`, which caches it), then `iss`,
 * `aud`, `exp`, `nbf` and `iat`, then decodes the payload into
 * {@link ActionsOidcClaims}. Every failure is a `JwtError`; route on its
 * `reason` (`wrongAudience`, `expired`, `claims`, ...), never on its message.
@@ -141,7 +161,8 @@ const testClaims = (overrides = {}) => ({
 * are refused as `wrongIssuer`.
 *
 * This module does not reach octokit: a service that only verifies tokens
-* links `@effected/jwt` and nothing else from this package.
+* links `@effected/oidc` and `@effected/jwt` and nothing else from this
+* package.
 *
 * @example
 * ```ts
@@ -176,4 +197,4 @@ const ActionsOidc = {
 	testClaims
 };
 
-export { ActionsOidc, ActionsOidcClaims };
+export { ActionsOidc, ActionsOidcClaims, ActionsOidcClaimsFromWire };

package/GitHubApp.js

@@ -3,8 +3,8 @@ import { GitHubGraphQLError } from "./GraphQL.js";
 import { GitHubClient, makeClientShape } from "./GitHubClient.js";
 import { numericId } from "./internal/ids.js";
 import { InstallationTokenStore } from "./InstallationTokenStore.js";
-import { Jwt, JwtKey } from "@effected/jwt";
 import { Cause, Clock, Context, DateTime, Deferred, Duration, Effect, Layer, Option, Redacted, Ref, Schema, Semaphore, Stream } from "effect";
+import { Jwt, JwtKey } from "@effected/jwt";
 
 // src/GitHubApp.ts
 /**

package/WorkflowDispatch.js

@@ -3,7 +3,7 @@ import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
 import { numericId } from "./internal/ids.js";
 import { PageOptions } from "./Rest.js";
-import { Clock, Context, Duration, Effect, Layer, Option, Schedule, Schema } from "effect";
+import { Context, DateTime, Duration, Effect, Layer, Option, Schedule, Schema } from "effect";
 
 // src/WorkflowDispatch.ts
 /**
@@ -205,7 +205,7 @@ const make = (client) => {
 				ref,
 				attempts
 			});
-			const dispatchedAt = new Date(yield* Clock.currentTimeMillis).toISOString();
+			const dispatchedAt = yield* Effect.map(DateTime.now, DateTime.formatIso);
 			const dispatched = yield* dispatchWithRun(workflow, ref, options?.inputs);
 			const findRun = Option.isSome(dispatched) ? Effect.map(runStatus(dispatched.value.runId), Option.some) : Effect.gen(function* () {
 				const match = (yield* client.paginate("GET /repos/{owner}/{repo}/actions/runs", {

package/index.d.ts

@@ -63,9 +63,46 @@ declare const ActionsOidcClaims_base: Schema.Class<ActionsOidcClaims, Schema.Str
  *
  * Claims GitHub adds that are not modelled here are dropped on decode.
  *
+ * To decode a payload as it arrives in the token (snake_case keys, string
+ * ids), use {@link ActionsOidcClaimsFromWire}; this class itself decodes the
+ * camelCase form.
+ *
  * @public
  */
 export declare class ActionsOidcClaims extends ActionsOidcClaims_base {}
+/**
+ * {@link ActionsOidcClaims} as the claims arrive in the token: snake_case
+ * keys and string ids, decoding to the class and encoding back to the wire.
+ *
+ * @remarks
+ * The codec {@link ActionsOidc.verify} decodes a verified payload with.
+ * Exported for reading a token this process already trusts, such as one the
+ * runner's own token service just issued, and for building one: encoding an
+ * instance yields the exact payload GitHub would sign.
+ *
+ * @example
+ * ```ts
+ * import { ActionsOidcClaimsFromWire } from "@effected/github";
+ * import { Oidc } from "@effected/oidc";
+ *
+ * // Unverified: only for a token handed over by a trusted runtime.
+ * const read = (token: string) => Oidc.decodeUnverified(token, ActionsOidcClaimsFromWire);
+ * ```
+ *
+ * @public
+ */
+export declare const ActionsOidcClaimsFromWire: Schema.encodeKeys<typeof ActionsOidcClaims, {
+  readonly repositoryId: "repository_id";
+  readonly repositoryOwner: "repository_owner";
+  readonly repositoryOwnerId: "repository_owner_id";
+  readonly runId: "run_id";
+  readonly runAttempt: "run_attempt";
+  readonly workflowRef: "workflow_ref";
+  readonly jobWorkflowRef: "job_workflow_ref";
+  readonly eventName: "event_name";
+  readonly actorId: "actor_id";
+  readonly runnerEnvironment: "runner_environment";
+}>;
 /**
  * Options for {@link ActionsOidc.verify}.
  *
@@ -87,8 +124,9 @@ interface ActionsOidcVerifyOptions {
  * repository, workflow and run it is.
  *
  * @remarks
- * {@link ActionsOidc.verify} checks the signature against GitHub's published
- * JWKS (through `@effected/jwt`'s `JwksResolver`, which caches it), then `iss`,
+ * {@link ActionsOidc.verify} is `@effected/oidc`'s `Oidc.verify` pinned to the
+ * Actions issuer: it checks the signature against GitHub's published JWKS
+ * (through `@effected/jwt`'s `JwksResolver`, which caches it), then `iss`,
  * `aud`, `exp`, `nbf` and `iat`, then decodes the payload into
  * {@link ActionsOidcClaims}. Every failure is a `JwtError`; route on its
  * `reason` (`wrongAudience`, `expired`, `claims`, ...), never on its message.
@@ -106,7 +144,8 @@ interface ActionsOidcVerifyOptions {
  * are refused as `wrongIssuer`.
  *
  * This module does not reach octokit: a service that only verifies tokens
- * links `@effected/jwt` and nothing else from this package.
+ * links `@effected/oidc` and `@effected/jwt` and nothing else from this
+ * package.
  *
  * @example
  * ```ts

package/index.js

@@ -1,4 +1,4 @@
-import { ActionsOidc, ActionsOidcClaims } from "./ActionsOidc.js";
+import { ActionsOidc, ActionsOidcClaims, ActionsOidcClaimsFromWire } from "./ActionsOidc.js";
 import { GitHubError, GitHubErrorKind, GitHubValidationCode, GitHubValidationEntry } from "./GitHubError.js";
 import { GitHubGraphQLError, GraphQLDocument, GraphQLErrorEntry } from "./GraphQL.js";
 import { RateLimitSnapshot, RetryPolicy } from "./Resilience.js";
@@ -31,4 +31,4 @@ import { ExtraPermission, PermissionGap, PermissionLevel, PermissionResult, Toke
 import { DispatchedRun, WorkflowDispatch, WorkflowRunStatus } from "./WorkflowDispatch.js";
 import { CLOSING_KEYWORDS, harvestIssueReferences, parseBareLineReference } from "@effected/github-references";
 
-export { ActionsOidc, ActionsOidcClaims, Annotation, AnnotationLevel, AppIdentity, AppInfo, ArtifactMetadata, Attestation, AttestationListEntry, AttestationRecord, AuthenticatedApp, BotIdentity, BotUser, CLOSING_KEYWORDS, CheckConclusion, CheckRun, CheckRunOutput, CheckRunRef, CheckRunStatus, CodeScanning, CommentMarker, CommentOnceResult, CommentRecord, CommitComparison, CommitFile, CommitRef, CommitSummary, DeliveryAttempt, DeploymentEnvironment, DispatchedRun, ExtraPermission, FileChange, FileContent, FileDeletion, FileMode, FileStatus, GRAPHQL_ONLY_SETTINGS, GitBranch, GitCommit, GitHubApp, GitHubAppError, GitHubClient, GitHubCommit, GitHubContent, GitHubError, GitHubErrorKind, GitHubFixtures, GitHubGraphQLError, GitHubIssue, GitHubRelease, GitHubRepository, GitHubValidationCode, GitHubValidationEntry, GitTag, GraphQLDocument, GraphQLErrorEntry, Installation, InstallationToken, InstallationTokenStore, InvalidRepoRefError, IssueInfo, LinkedIssue, MergeMethod, PageOptions, PermissionGap, PermissionLevel, PermissionResult, PullRequest, PullRequestComment, PullRequestInfo, RateLimitSnapshot, RawFailure, ReleaseAsset, ReleaseInfo, Repo, RepoRef, ReportedCheckConclusion, ReportedCheckRunOutput, RepositorySecret, RepositorySecurity, RepositoryVariable, RetryPolicy, Ruleset, SECURITY_ANALYSIS_STATUS_FIELDS, SemverTag, StorageRecordInput, TagRef, TokenPermissionError, TokenPermissions, WorkflowDispatch, WorkflowRunStatus, harvestIssueReferences, parseBareLineReference, repositoryPatch, transformSecurityAndAnalysis, versionFromTag };
+export { ActionsOidc, ActionsOidcClaims, ActionsOidcClaimsFromWire, Annotation, AnnotationLevel, AppIdentity, AppInfo, ArtifactMetadata, Attestation, AttestationListEntry, AttestationRecord, AuthenticatedApp, BotIdentity, BotUser, CLOSING_KEYWORDS, CheckConclusion, CheckRun, CheckRunOutput, CheckRunRef, CheckRunStatus, CodeScanning, CommentMarker, CommentOnceResult, CommentRecord, CommitComparison, CommitFile, CommitRef, CommitSummary, DeliveryAttempt, DeploymentEnvironment, DispatchedRun, ExtraPermission, FileChange, FileContent, FileDeletion, FileMode, FileStatus, GRAPHQL_ONLY_SETTINGS, GitBranch, GitCommit, GitHubApp, GitHubAppError, GitHubClient, GitHubCommit, GitHubContent, GitHubError, GitHubErrorKind, GitHubFixtures, GitHubGraphQLError, GitHubIssue, GitHubRelease, GitHubRepository, GitHubValidationCode, GitHubValidationEntry, GitTag, GraphQLDocument, GraphQLErrorEntry, Installation, InstallationToken, InstallationTokenStore, InvalidRepoRefError, IssueInfo, LinkedIssue, MergeMethod, PageOptions, PermissionGap, PermissionLevel, PermissionResult, PullRequest, PullRequestComment, PullRequestInfo, RateLimitSnapshot, RawFailure, ReleaseAsset, ReleaseInfo, Repo, RepoRef, ReportedCheckConclusion, ReportedCheckRunOutput, RepositorySecret, RepositorySecurity, RepositoryVariable, RetryPolicy, Ruleset, SECURITY_ANALYSIS_STATUS_FIELDS, SemverTag, StorageRecordInput, TagRef, TokenPermissionError, TokenPermissions, WorkflowDispatch, WorkflowRunStatus, harvestIssueReferences, parseBareLineReference, repositoryPatch, transformSecurityAndAnalysis, versionFromTag };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/github",
-	"version": "0.22.0",
+	"version": "0.23.0",
 	"private": false,
 	"description": "Typed GitHub REST and GraphQL services over the octokit core request surface, with app auth and resource helpers.",
 	"keywords": [
@@ -40,6 +40,7 @@
 	"dependencies": {
 		"@effected/github-references": "^0.11.0",
 		"@effected/jwt": "^0.5.0",
+		"@effected/oidc": "^0.1.0",
 		"@effected/semver": "^0.15.0",
 		"@octokit/core": "^7.0.6",
 		"@octokit/plugin-paginate-rest": "^16.0.0",