@gtrevorrow/oci-token-exchange 1.0.0-20250417-beta

package/LICENSE.txt

@@ -0,0 +1,35 @@
+Copyright (c) 2024 Oracle and/or its affiliates.
+
+The Universal Permissive License (UPL), Version 1.0
+
+Subject to the condition set forth below, permission is hereby granted to any
+person obtaining a copy of this software, associated documentation and/or data
+(collectively the "Software"), free of charge and under any and all copyright
+rights in the Software, and any and all patent rights owned or freely
+licensable by each licensor hereunder covering either (i) the unmodified
+Software as contributed to or provided by such licensor, or (ii) the Larger
+Works (as defined below), to deal in both
+
+(a) the Software, and
+(b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
+one is included with the Software (each a "Larger Work" to which the Software
+is contributed by such licensors),
+
+without restriction, including without limitation the rights to copy, create
+derivative works of, display, perform, and distribute the Software and make,
+use, sell, offer for sale, import, export, have made, and have sold the
+Software and the Larger Work(s), and to sublicense the foregoing rights on
+either these or other terms.
+
+This license is subject to the following condition:
+The above copyright notice and either this complete permission notice or at
+a minimum a reference to the UPL must be included in all copies or
+substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,329 @@
+# OCI Token Exchange
+
+## Table of Contents
+
+- [Installation](#installation)
+  - [As GitHub Action](#as-github-action)
+  - [As CLI Tool](#as-cli-tool)
+- [Usage](#usage)
+  - [GitHub Actions](#github-actions)
+  - [GitLab CI](#gitlab-ci)
+    - [Option 1: Building from Source](#option-1-building-from-source)
+    - [Option 2: Using npm Package](#option-2-using-npm-package)
+  - [Bitbucket Pipelines](#bitbucket-pipelines)
+    - [Option 1: Building from Source](#option-1-building-from-source-1)
+    - [Option 2: Using npm Package](#option-2-using-npm-package-1)
+  - [Standalone CLI Usage](#standalone-cli-usage)
+  - [Debugging](#debugging)
+- [Environment Variables / Github Secrets](#environment-variables--github-secrets)
+  - [Environment Variable Handling](#environment-variable-handling)
+- [How it Works](#how-it-works)
+- [Semantic Versioning](#semantic-versioning)
+- [License](#license)
+- [Contributing](#contributing)
+
+# OCI Token Exchange
+
+A tool to exchange OIDC tokens for [OCI session tokens](https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/clitoken.htm), supporting multiple CI platforms:
+- GitHub Actions
+- GitLab CI
+- Bitbucket Pipelines
+
+## Installation
+
+### As GitHub Action
+```yaml
+- uses: gtrevorrow/oci-token-exchange-action@v1
+```
+
+### As CLI Tool
+```bash
+npm install -g @gtrevorrow/oci-token-exchange
+
+# Install the latest version globally
+npm install -g @gtrevorrow/oci-token-exchange
+
+# Install a specific version globally (e.g., 1.2.3)
+npm install -g @gtrevorrow/oci-token-exchange@1.2.3
+
+# Install a version with a specific tag (e.g., beta)
+npm install -g @gtrevorrow/oci-token-exchange@beta
+```
+
+## Usage
+
+### GitHub Actions
+```yaml
+- uses: gtrevorrow/oci-token-exchange-action@v1
+  with:
+    oidc_client_identifier: ${{ secrets.OIDC_CLIENT_ID }}
+    domain_base_url: ${{ secrets.DOMAIN_URL }}
+    oci_tenancy: ${{ secrets.OCI_TENANCY }}
+    oci_region: ${{ secrets.OCI_REGION }}
+```
+
+### GitLab CI
+
+#### Option 1: Building from Source
+
+This example clones the repository, builds the CLI, and then runs it.
+
+```yaml
+# Use these YAML anchors to setup common tasks
+.oci_setup: &oci_setup |
+  curl -LO https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh
+  bash install.sh --accept-all-defaults
+  source ~/.bashrc
+
+.clone_build_cli: &clone_build_cli |
+  git clone https://github.com/gtrevorrow/oci-token-exchange-action.git
+  cd oci-token-exchange-action
+  npm ci
+  npm run build:cli
+
+deploy:
+  script:
+    # Install OCI CLI
+    - *oci_setup
+    
+    # Clone and build the token exchange CLI
+    - *clone_build_cli
+    
+    # Export token from GitLab CI
+    - export CI_JOB_JWT_V2="$(cat $CI_JOB_JWT_FILE)"
+    
+    # Run the built CLI
+    - |
+      cd dist &&
+      PLATFORM=gitlab \
+      OIDC_CLIENT_ID=${OIDC_CLIENT_ID} \
+      DOMAIN_URL=${DOMAIN_URL} \
+      OCI_TENANCY=${OCI_TENANCY} \
+      OCI_REGION=${OCI_REGION} \
+      RETRY_COUNT=3 \
+      node cli.js
+    
+    # Verify OCI CLI configuration works
+    - cd ../..
+    - oci os ns get
+  
+  # Run only on main branch
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main"
+  
+  # Configure OIDC token for GitLab
+  id_tokens:
+    ID_TOKEN:
+      aud: https://cloud.oracle.com/gitlab
+```
+
+#### Option 2: Using npm Package
+
+This example installs the CLI tool directly from npm.
+
+```yaml
+# Use these YAML anchors to setup common tasks
+.oci_setup: &oci_setup |
+  curl -LO https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh
+  bash install.sh --accept-all-defaults
+  source ~/.bashrc
+
+deploy_npm:
+  script:
+    # Install OCI CLI
+    - *oci_setup
+    
+    # Install the token exchange CLI from npm
+    - npm install -g @gtrevorrow/oci-token-exchange
+    
+    # Export token from GitLab CI
+    - export CI_JOB_JWT_V2="$(cat $CI_JOB_JWT_FILE)"
+    
+    # Run the installed CLI
+    - |
+      PLATFORM=gitlab \
+      OIDC_CLIENT_ID=${OIDC_CLIENT_ID} \
+      DOMAIN_URL=${DOMAIN_URL} \
+      OCI_TENANCY=${OCI_TENANCY} \
+      OCI_REGION=${OCI_REGION} \
+      RETRY_COUNT=3 \
+      oci-token-exchange
+    
+    # Verify OCI CLI configuration works
+    - oci os ns get
+  
+  # Run only on main branch
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main"
+  
+  # Configure OIDC token for GitLab
+  id_tokens:
+    ID_TOKEN:
+      aud: https://cloud.oracle.com/gitlab
+```
+
+### Bitbucket Pipelines
+
+#### Option 1: Building from Source
+
+This example clones the repository, builds the CLI, and then runs it.
+
+```yaml
+image: node:20
+
+pipelines:
+  default:
+    - step:
+        name: Setup OCI CLI with OIDC Token Exchange (Build from Source)
+        oidc: true  # Enable OIDC for Bitbucket
+        script:
+          # Setup OCI CLI
+          - curl -LO https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh
+          - bash install.sh --accept-all-defaults
+          - export PATH=$PATH:/root/bin
+          
+          # Clone and build the token exchange CLI from GitHub
+          - git clone https://github.com/gtrevorrow/oci-token-exchange-action.git
+          - cd oci-token-exchange-action
+          - npm ci
+          - npm run build:cli
+          
+          # Run the built CLI for token exchange
+          - >
+            cd dist &&
+            export PLATFORM=bitbucket &&
+            export OIDC_CLIENT_ID=${OIDC_CLIENT_ID} &&
+            export DOMAIN_URL=${DOMAIN_URL} &&
+            export OCI_TENANCY=${OCI_TENANCY} &&
+            export OCI_REGION=${OCI_REGION} &&
+            export RETRY_COUNT=3
+          - node cli.js || exit 1
+          
+          # Verify OCI CLI works with generated token
+          - cd ../..
+          - oci os ns get
+        
+        # Preserve credentials for subsequent steps
+        artifacts:
+          - ".oci/**"
+          - "private_key.pem"
+          - "public_key.pem"
+          - "session"
+```
+
+#### Option 2: Using npm Package
+
+This example installs the CLI tool directly from npm.
+
+```yaml
+image: node:20
+
+pipelines:
+  default:
+    - step:
+        name: Setup OCI CLI with OIDC Token Exchange (npm Package)
+        oidc: true  # Enable OIDC for Bitbucket
+        script:
+          # Setup OCI CLI
+          - curl -LO https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh
+          - bash install.sh --accept-all-defaults
+          - export PATH=$PATH:/root/bin
+          
+          # Install the token exchange CLI from npm
+          - npm install -g @gtrevorrow/oci-token-exchange
+          
+          # Run the installed CLI for token exchange
+          - >
+            export PLATFORM=bitbucket &&
+            export OIDC_CLIENT_ID=${OIDC_CLIENT_ID} &&
+            export DOMAIN_URL=${DOMAIN_URL} &&
+            export OCI_TENANCY=${OCI_TENANCY} &&
+            export OCI_REGION=${OCI_REGION} &&
+            export RETRY_COUNT=3
+          - oci-token-exchange || exit 1
+          
+          # Verify OCI CLI works with generated token
+          - oci os ns get
+        
+        # Preserve credentials for subsequent steps
+        artifacts:
+          - ".oci/**"
+          - "private_key.pem"
+          - "public_key.pem"
+          - "session"
+```
+
+### Standalone CLI Usage
+```bash
+# Install globally
+npm install -g @gtrevorrow/oci-token-exchange
+
+# Run with required environment variables
+export LOCAL_OIDC_TOKEN="your.jwt.token"
+PLATFORM=local \
+OIDC_CLIENT_ID=your-client-id \
+DOMAIN_URL=https://your-domain.identity.oraclecloud.com \
+OCI_TENANCY=your-tenancy-ocid \
+OCI_REGION=your-region \
+oci-token-exchange
+
+# Use the configured OCI CLI
+oci os ns get
+```
+
+### Debugging
+
+To enable detailed logging, set the `DEBUG` environment variable to `true`:
+
+```bash
+export DEBUG=true
+```
+
+This will log additional information, such as token exchange requests and responses, to help with troubleshooting.
+
+## Environment Variables / Github Secrets 
+
+The action supports flexible environment variable naming to make it easier to use across different platforms:
+
+| Variable | Alternate Names | Description | Required |
+|----------|----------------|-------------|----------|
+| `OIDC_CLIENT_IDENTIFIER` | `INPUT_OIDC_CLIENT_IDENTIFIER` | OIDC client identifier | Yes |
+| `DOMAIN_BASE_URL` | `INPUT_DOMAIN_BASE_URL` | Base URL of OCI Identity Domain | Yes |
+| `OCI_TENANCY` | `INPUT_OCI_TENANCY` | OCI tenancy OCID | Yes |
+| `OCI_REGION` | `INPUT_OCI_REGION` | OCI region identifier | Yes |
+| `PLATFORM` | `INPUT_PLATFORM` | CI platform (`github`, `gitlab`, `bitbucket`, or `local`) | No (default: `github`) |
+| `RETRY_COUNT` | `INPUT_RETRY_COUNT` | Number of retry attempts | No (default: `0`) |
+| `LOCAL_OIDC_TOKEN` | - | OIDC token when using PLATFORM=local | Yes, when platform=local |
+| `CI_JOB_JWT_V2` | - | GitLab CI JWT token | Yes, when platform=gitlab |
+| `BITBUCKET_STEP_OIDC_TOKEN` | - | Bitbucket OIDC token | Yes, when platform=bitbucket |
+| `DEBUG` | - | Enable debug output | No (default: `false`) |
+
+### Environment Variable Handling
+
+Variables can be provided in two ways:
+
+1. **GitHub Actions Format**: Variables in the format `INPUT_VARIABLE_NAME` (used by GitHub Actions)
+2. **Standard Format**: Plain environment variables matching the exact names listed above
+
+The GitHub Action automatically maps variables from GitHub's format to the standard format, but if you're using the CLI directly, use the variable names exactly as shown above.
+
+## How it Works
+
+1. Generates an RSA key pair 
+2. Requests a GitHub OIDC JWT token
+3. Exchanges the JWT for an OCI UPST token
+4. Configures the OCI CLI with the obtained credentials
+
+## Semantic Versioning
+
+This project uses [semantic-release](https://github.com/semantic-release/semantic-release) for automated versioning and publishing.  
+**For details on the build and release process, see [CONTRIBUTING.md](./CONTRIBUTING.md).**
+
+## License
+
+This action is licensed under the [Universal Permissive License v1.0 (UPL-1.0)](LICENSE.txt).
+
+## Contributing
+
+Contributions are welcome! Please feel free to submit a Pull Request.
+````

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const main_1 = require("./main");
+// Map environment variables to GitHub Actions input format
+// This mapping provides flexibility for users to follow different naming conventions
+const envVarMappings = {
+    // Standard CLI env vars
+    PLATFORM: 'platform',
+    OIDC_CLIENT_IDENTIFIER: 'oidc_client_identifier',
+    DOMAIN_BASE_URL: 'domain_base_url',
+    OCI_TENANCY: 'oci_tenancy',
+    OCI_REGION: 'oci_region',
+    RETRY_COUNT: 'retry_count',
+    // Support for directly providing GitHub Actions style input vars
+    // This prevents needless remapping if already in correct format
+    INPUT_PLATFORM: 'platform',
+    INPUT_OIDC_CLIENT_IDENTIFIER: 'oidc_client_identifier',
+    INPUT_DOMAIN_BASE_URL: 'domain_base_url',
+    INPUT_OCI_TENANCY: 'oci_tenancy',
+    INPUT_OCI_REGION: 'oci_region',
+    INPUT_RETRY_COUNT: 'retry_count'
+};
+// Set environment variables in GitHub Actions format only if not already set
+Object.entries(envVarMappings).forEach(([envVar, inputName]) => {
+    const value = process.env[envVar];
+    if (value && !process.env[`INPUT_${inputName.toUpperCase()}`]) {
+        process.env[`INPUT_${inputName.toUpperCase()}`] = value;
+    }
+});
+// Enable debug mode via environment variable
+if (process.env.DEBUG === 'true') {
+    console.log('Debug mode enabled');
+    console.log('Environment variables mapped:');
+    Object.entries(envVarMappings).forEach(([envVar, inputName]) => {
+        if (process.env[envVar]) {
+            console.log(`${envVar} → INPUT_${inputName.toUpperCase()}`);
+        }
+    });
+}
+// Run the main function
+(0, main_1.main)().catch(error => {
+    console.error('Error:', error instanceof Error ? error.message : 'Unknown error');
+    process.exit(1);
+});

package/dist/index.d.ts

@@ -0,0 +1 @@
+export * from './main';

package/dist/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./main"), exports);

package/dist/main.d.ts

@@ -0,0 +1,6 @@
+import { Platform } from './platforms/types';
+import { TokenExchangeConfig, OciConfig, UpstTokenResponse, TokenExchangeError } from './types';
+export declare function tokenExchangeJwtToUpst(platform: Platform, { tokenExchangeURL, clientCred, ociPublicKey, subjectToken, retryCount, currentAttempt }: TokenExchangeConfig): Promise<UpstTokenResponse>;
+export declare function configureOciCli(platform: Platform, config: OciConfig): Promise<void>;
+export declare function main(): Promise<void>;
+export { TokenExchangeError, TokenExchangeConfig, OciConfig };

package/dist/main.js

@@ -0,0 +1,366 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenExchangeError = void 0;
+exports.tokenExchangeJwtToUpst = tokenExchangeJwtToUpst;
+exports.configureOciCli = configureOciCli;
+exports.main = main;
+/**
+ * Copyright (c) 2021, 2024 Oracle and/or its affiliates.
+ * Licensed under the Universal Permissive License v1.0 as shown at https://oss.oracle.com/licenses/upl.
+ */
+const fs = __importStar(require("fs/promises"));
+const path = __importStar(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
+const axios_1 = __importDefault(require("axios"));
+const github_1 = require("./platforms/github");
+const cli_1 = require("./platforms/cli");
+const types_1 = require("./types");
+Object.defineProperty(exports, "TokenExchangeError", { enumerable: true, get: function () { return types_1.TokenExchangeError; } });
+const PLATFORM_CONFIGS = {
+    github: {
+        audience: 'https://cloud.oracle.com'
+    },
+    gitlab: {
+        tokenEnvVar: 'CI_JOB_JWT_V2',
+        audience: 'https://cloud.oracle.com/gitlab'
+    },
+    bitbucket: {
+        tokenEnvVar: 'BITBUCKET_STEP_OIDC_TOKEN',
+        audience: 'https://cloud.oracle.com/bitbucket'
+    },
+    local: {
+        tokenEnvVar: 'LOCAL_OIDC_TOKEN',
+        audience: 'https://cloud.oracle.com'
+    }
+};
+// Create platform instance based on environment
+function createPlatform(platformType) {
+    const config = PLATFORM_CONFIGS[platformType];
+    if (!config) {
+        throw new Error(`Unsupported platform: ${platformType}`);
+    }
+    return platformType === 'github' ? new github_1.GitHubPlatform() : new cli_1.CLIPlatform(config);
+}
+// Generate RSA key pair
+const { publicKey, privateKey } = crypto_1.default.generateKeyPairSync('rsa', {
+    modulusLength: 2048
+});
+async function delay(count) {
+    return new Promise(resolve => setTimeout(resolve, 1000 * count));
+}
+// Encode public key in a format the OCI token exchange endpoint expects
+function encodePublicKeyToBase64() {
+    return publicKey.export({ type: 'spki', format: 'der' }).toString('base64');
+}
+// Calculate the fingerprint of the OCI API public key
+function calcFingerprint(publicKey) {
+    const publicKeyData = publicKey.export({ type: 'spki', format: 'der' });
+    const hash = crypto_1.default.createHash('MD5');
+    hash.update(publicKeyData);
+    return hash.digest('hex').replace(/(.{2})/g, '$1:').slice(0, -1);
+}
+// Function to validate URLs
+function isValidUrl(url) {
+    try {
+        new URL(url);
+        return true;
+    }
+    catch (_) {
+        return false;
+    }
+}
+// Function to exchange JWT for OCI UPST token
+async function tokenExchangeJwtToUpst(platform, { tokenExchangeURL, clientCred, ociPublicKey, subjectToken, retryCount, currentAttempt = 0 }) {
+    const headers = {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        'Authorization': `Basic ${clientCred}`
+    };
+    if (subjectToken && platform.isDebug()) {
+        // Do some basic validation on the JWT token that we are going to exchange
+        try {
+            const parts = subjectToken.split('.');
+            // Check if the token is already a valid JWT (has at least 2 periods)
+            if (parts.length == 3) {
+                // If not well-formed, it might be a raw JWT that needs to be formatted
+                platform.logger.debug(' OIDC token does not appear to be a properly formatted JWT, attempting to parse');
+            }
+            else {
+                // Try to parse the token segments to validate it's a proper(ish) JWT
+                // Note: This is a very basic check and does not guarantee the token's validity
+                const header = JSON.parse(Buffer.from(parts[0], 'base64').toString());
+                const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+                platform.logger.debug(`JWT appears structured as expected with a header , payload and signature . Issuer: ${payload.iss || 'unknown'}`);
+            }
+        }
+        catch (error) {
+            platform.logger.warning(`Error pre-processing OIDC token: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            // Continue with the original token, as we may be mistaken about its format
+        }
+    }
+    const data = {
+        'grant_type': 'urn:ietf:params:oauth:grant-type:token-exchange',
+        'requested_token_type': 'urn:oci:token-type:oci-upst',
+        'public_key': ociPublicKey,
+        'subject_token': subjectToken,
+        'subject_token_type': 'jwt'
+    };
+    // Note that this will log potentially sensitive information but will leave it up to the user to decide if they want to enable debug logging with this risk
+    platform.logger.debug('Token Exchange Request Data: ' + JSON.stringify(data));
+    try {
+        const response = await axios_1.default.post(tokenExchangeURL, data, { headers });
+        platform.logger.debug('Token Exchange Response: ' + JSON.stringify(response.data));
+        return response.data; // auto wrapped in a Promise
+    }
+    catch (error) {
+        const attemptCounter = currentAttempt ? currentAttempt : 0;
+        if (retryCount > 0 && retryCount >= attemptCounter) {
+            platform.logger.warning(`Token exchange failed, retrying ... (${retryCount - attemptCounter - 1} retries left)`);
+            await delay(attemptCounter + 1);
+            return tokenExchangeJwtToUpst(platform, {
+                tokenExchangeURL,
+                clientCred,
+                ociPublicKey,
+                subjectToken: subjectToken,
+                retryCount,
+                currentAttempt: attemptCounter + 1
+            });
+        }
+        else {
+            platform.logger.error('Failed to exchange JWT for UPST after multiple attempts');
+            if (error instanceof Error) {
+                throw new types_1.TokenExchangeError(`Token exchange failed: ${error.message}`, error);
+            }
+            else {
+                throw new types_1.TokenExchangeError('Token exchange failed with an unknown error');
+            }
+        }
+    }
+}
+// Update configureOciCli to accept platform as first parameter
+async function configureOciCli(platform, config) {
+    try {
+        const home = process.env.HOME || '';
+        if (!home) {
+            throw new types_1.TokenExchangeError('HOME environment variable is not defined');
+        }
+        // Sanitize file paths to prevent path injection
+        const ociConfigDir = path.resolve(path.join(home, '.oci'));
+        const ociConfigFile = path.resolve(path.join(ociConfigDir, 'config'));
+        const ociPrivateKeyFile = path.resolve(path.join(home, 'private_key.pem'));
+        const ociPublicKeyFile = path.resolve(path.join(home, 'public_key.pem'));
+        const upstTokenFile = path.resolve(path.join(home, 'session'));
+        platform.logger.debug(`OCI Config Dir: ${ociConfigDir}`);
+        const ociConfig = `[DEFAULT]
+    user='not used'
+    fingerprint=${config.ociFingerprint}
+    key_file=${ociPrivateKeyFile}
+    tenancy=${config.ociTenancy}
+    region=${config.ociRegion}
+    security_token_file=${upstTokenFile}
+    `;
+        try {
+            await fs.mkdir(ociConfigDir, { recursive: true });
+        }
+        catch (error) {
+            throw new Error('Unable to create OCI Config folder');
+        }
+        platform.logger.debug(`Created OCI Config : ${ociConfig}`);
+        try {
+            // Use await/try-catch for fs.access instead of chaining then/catch
+            try {
+                await fs.access(ociConfigFile);
+                platform.logger.warning(`Overwriting existing config file at ${ociConfigFile}`);
+            }
+            catch (e) {
+                // File does not exist, proceed silently
+            }
+            // Export and validate keys first
+            const privateKeyPem = config.privateKey.export({ type: 'pkcs1', format: 'pem' });
+            const publicKeyPem = config.publicKey.export({ type: 'spki', format: 'pem' });
+            if (!privateKeyPem || typeof privateKeyPem !== 'string') {
+                throw new Error('Private key export failed or invalid type');
+            }
+            if (!publicKeyPem || typeof publicKeyPem !== 'string') {
+                throw new Error('Public key export failed or invalid type');
+            }
+            if (!config.upstToken || typeof config.upstToken !== 'string') {
+                throw new Error('Session token is undefined or invalid type');
+            }
+            if (!ociConfig || typeof ociConfig !== 'string') {
+                throw new Error('OCI config is undefined or invalid type');
+            }
+            platform.logger.debug('Validated all file contents before writing');
+            await Promise.all([
+                fs.writeFile(ociConfigFile, ociConfig)
+                    .then(() => platform.logger.debug(`Successfully wrote OCI config to ${ociConfigFile}`)),
+                fs.writeFile(ociPrivateKeyFile, privateKeyPem)
+                    .then(() => fs.chmod(ociPrivateKeyFile, '600'))
+                    .then(() => platform.logger.debug(`Successfully wrote private key to ${ociPrivateKeyFile} with permissions 600`)),
+                fs.writeFile(ociPublicKeyFile, publicKeyPem)
+                    .then(() => platform.logger.debug(`Successfully wrote public key to ${ociPublicKeyFile}`)),
+                fs.writeFile(upstTokenFile, config.upstToken)
+                    .then(() => fs.chmod(upstTokenFile, '600'))
+                    .then(() => platform.logger.debug(`Successfully wrote session token to ${upstTokenFile}`))
+            ]);
+        }
+        catch (error) {
+            throw new types_1.TokenExchangeError('Failed to write OCI configuration files', error);
+        }
+    }
+    catch (error) {
+        platform.setFailed(`Failed to configure OCI CLI: ${error}`);
+        throw error;
+    }
+}
+// Update debugPrintJWTToken to properly handle different token formats
+function debugPrintJWTToken(platform, token) {
+    if (platform.isDebug()) {
+        platform.logger.debug(`JWT Token received (length: ${token.length} characters)`);
+        try {
+            const tokenParts = token.split('.');
+            if (tokenParts.length !== 3) {
+                platform.logger.debug(`Warning: JWT token does not have the expected format (header.payload.signature)`);
+                return;
+            }
+            // Only decode and print the header and selected parts of payload, not the full token
+            const headerStr = Buffer.from(tokenParts[0], 'base64').toString('utf8');
+            let header;
+            try {
+                header = JSON.parse(headerStr);
+                platform.logger.debug(`JWT Header: ${JSON.stringify(header)}`);
+            }
+            catch (e) {
+                platform.logger.debug(`Failed to parse JWT header: ${headerStr}`);
+            }
+            // Parse payload but only log safe information
+            try {
+                const payloadStr = Buffer.from(tokenParts[1], 'base64').toString('utf8');
+                const payload = JSON.parse(payloadStr);
+                const safePayload = {
+                    iss: payload.iss,
+                    aud: payload.aud,
+                    exp: payload.exp,
+                    iat: payload.iat,
+                    sub: payload.sub ? `${payload.sub.substring(0, 10)}...` : undefined,
+                    // Include timestamp information for troubleshooting token expiry issues
+                    expires_at: payload.exp ? new Date(payload.exp * 1000).toISOString() : undefined,
+                    issued_at: payload.iat ? new Date(payload.iat * 1000).toISOString() : undefined
+                };
+                platform.logger.debug(`JWT Payload (safe parts): ${JSON.stringify(safePayload)}`);
+            }
+            catch (e) {
+                platform.logger.debug(`Failed to parse JWT payload: ${e instanceof Error ? e.message : 'Unknown error'}`);
+            }
+            platform.logger.debug(`JWT Signature present: ${tokenParts[2].length > 0 ? 'Yes' : 'No'}`);
+        }
+        catch (error) {
+            platform.logger.debug(`Error parsing JWT token: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+    }
+}
+// Main function now creates a local platform instance and passes it to subfunctions
+async function main() {
+    const platformType = process.env.PLATFORM || 'github';
+    if (!PLATFORM_CONFIGS[platformType]) {
+        throw new Error(`Unsupported platform: ${platformType}`);
+    }
+    const platform = createPlatform(platformType);
+    try {
+        // Use typed object for config
+        const config = ['oidc_client_identifier', 'domain_base_url', 'oci_tenancy', 'oci_region']
+            .reduce((acc, input) => ({
+            ...acc,
+            [input]: platform.getInput(input, true)
+        }), {});
+        const retryCount = parseInt(platform.getInput('retry_count', false) || '0');
+        if (isNaN(retryCount) || retryCount < 0) {
+            throw new Error('retry_count must be a non-negative number');
+        }
+        // Validate the tokenExchangeURL
+        if (!isValidUrl(`${config.domain_base_url}/oauth2/v1/token`)) {
+            throw new Error('Invalid domain_base_url provided');
+        }
+        const idToken = await platform.getOIDCToken(PLATFORM_CONFIGS[platformType].audience);
+        platform.logger.debug(`Token obtained from ${platformType}`);
+        debugPrintJWTToken(platform, idToken);
+        // Calculate the fingerprint of the public key
+        const ociFingerprint = calcFingerprint(publicKey);
+        // Get the B64 encoded public key DER
+        const publicKeyB64 = encodePublicKeyToBase64();
+        platform.logger.debug(`Public Key B64: ${publicKeyB64}`);
+        //Exchange platform OIDC token for OCI UPST
+        const upstToken = await tokenExchangeJwtToUpst(platform, {
+            tokenExchangeURL: `${config.domain_base_url}/oauth2/v1/token`,
+            clientCred: Buffer.from(config.oidc_client_identifier).toString('base64'),
+            ociPublicKey: publicKeyB64,
+            subjectToken: idToken,
+            retryCount
+        });
+        platform.logger.info(`OCI issued a Session Token `);
+        //Setup the OCI cli/sdk on the CI platform runner with the UPST token
+        const ociConfig = {
+            privateKey,
+            publicKey,
+            upstToken: upstToken.token,
+            ociFingerprint,
+            ociTenancy: config.oci_tenancy,
+            ociRegion: config.oci_region
+        };
+        await configureOciCli(platform, ociConfig);
+        platform.logger.info(`OCI CLI has been configured to use the session token`);
+        // Add success output
+        platform.setOutput('configured', 'true');
+        // Error Handling
+    }
+    catch (error) {
+        if (error instanceof types_1.TokenExchangeError) {
+            platform.setFailed(`Token exchange failed: ${error.message}`);
+            if (error.cause) {
+                platform.logger.debug(`Cause: ${error.cause}`);
+            }
+        }
+        else {
+            platform.setFailed(`Action failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+        throw error;
+    }
+}
+if (require.main === module) {
+    main();
+}

package/dist/platforms/cli.d.ts

@@ -0,0 +1,12 @@
+import { Platform, PlatformLogger, PlatformConfig } from './types';
+export declare class CLIPlatform implements Platform {
+    private config;
+    private readonly _logger;
+    constructor(config: PlatformConfig);
+    getInput(name: string, required?: boolean): string;
+    setOutput(name: string, value: string): void;
+    setFailed(message: string): void;
+    isDebug(): boolean;
+    getOIDCToken(audience: string): Promise<string>;
+    get logger(): PlatformLogger;
+}

package/dist/platforms/cli.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLIPlatform = void 0;
+class CLIPlatform {
+    constructor(config) {
+        this.config = config;
+        this._logger = {
+            debug: (message) => { if (this.isDebug())
+                console.debug(message); },
+            info: (message) => console.log(message),
+            warning: (message) => console.warn(message),
+            error: (message) => console.error(message)
+        };
+    }
+    getInput(name, required = false) {
+        // Then check for direct environment variable (using common naming conventions)
+        const value = process.env[name.toUpperCase()] ||
+            process.env[`INPUT_${name.toUpperCase()}`] ||
+            process.env[`OCI_${name.toUpperCase()}`] ||
+            process.env[`OIDC_${name.toUpperCase()}`] || '';
+        if (required && !value) {
+            throw new Error(`Input required and not supplied: ${name}`);
+        }
+        return value;
+    }
+    setOutput(name, value) {
+        console.log(`::set-output name=${name}::${value}`);
+    }
+    setFailed(message) {
+        console.error(message);
+        process.exit(1);
+    }
+    isDebug() {
+        return process.env.DEBUG === 'true';
+    }
+    async getOIDCToken(audience) {
+        if (this.config.tokenEnvVar) {
+            const token = process.env[this.config.tokenEnvVar];
+            if (!token) {
+                throw new Error(`${this.config.tokenEnvVar} environment variable not found`);
+            }
+            // Do not log the token here
+            return token;
+        }
+        throw new Error('No OIDC token configuration available');
+    }
+    get logger() {
+        return this._logger;
+    }
+}
+exports.CLIPlatform = CLIPlatform;

package/dist/platforms/github.d.ts

@@ -0,0 +1,10 @@
+import { Platform, PlatformLogger } from './types';
+export declare class GitHubPlatform implements Platform {
+    private readonly _logger;
+    getInput(name: string, required?: boolean): string;
+    setOutput(name: string, value: string): void;
+    setFailed(message: string): void;
+    isDebug(): boolean;
+    getOIDCToken(audience: string): Promise<string>;
+    get logger(): PlatformLogger;
+}

package/dist/platforms/github.js

@@ -0,0 +1,70 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitHubPlatform = void 0;
+const core = __importStar(require("@actions/core"));
+class GitHubPlatform {
+    constructor() {
+        this._logger = {
+            debug: (message) => core.debug(message),
+            info: (message) => core.info(message),
+            warning: (message) => core.warning(message),
+            error: (message) => core.error(message)
+        };
+    }
+    getInput(name, required = false) {
+        return core.getInput(name, { required });
+    }
+    setOutput(name, value) {
+        core.setOutput(name, value);
+    }
+    setFailed(message) {
+        core.setFailed(message);
+    }
+    isDebug() {
+        return core.isDebug();
+    }
+    async getOIDCToken(audience) {
+        const token = await core.getIDToken(audience);
+        if (!token) {
+            throw new Error('Failed to get OIDC token from GitHub Actions');
+        }
+        return token;
+    }
+    get logger() {
+        return this._logger;
+    }
+}
+exports.GitHubPlatform = GitHubPlatform;

package/dist/platforms/types.d.ts

@@ -0,0 +1,18 @@
+export interface PlatformLogger {
+    debug(message: string): void;
+    info(message: string): void;
+    warning(message: string): void;
+    error(message: string): void;
+}
+export interface Platform {
+    getInput(name: string, required?: boolean): string;
+    setOutput(name: string, value: string): void;
+    setFailed(message: string): void;
+    isDebug(): boolean;
+    logger: PlatformLogger;
+    getOIDCToken(audience: string): Promise<string>;
+}
+export interface PlatformConfig {
+    tokenEnvVar?: string;
+    audience: string;
+}

package/dist/platforms/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/types.d.ts

@@ -0,0 +1,89 @@
+import crypto from 'crypto';
+/**
+ * Configuration for token exchange operation
+ */
+export interface TokenExchangeConfig {
+    /**
+     * URL of the token exchange endpoint
+     */
+    tokenExchangeURL: string;
+    /**
+     * Base64-encoded client credentials
+     */
+    clientCred: string;
+    /**
+     * Base64-encoded DER format of the OCI public key
+     */
+    ociPublicKey: string;
+    /**
+     * JWT token to be exchanged
+     */
+    subjectToken: string;
+    /**
+     * Number of retry attempts for token exchange
+     */
+    retryCount: number;
+    /**
+     * Current attempt number (used internally for retries)
+     */
+    currentAttempt?: number;
+}
+/**
+ * Configuration for the OCI CLI setup
+ */
+export interface OciConfig {
+    /**
+     * Private key used for OCI authentication
+     */
+    privateKey: crypto.KeyObject;
+    /**
+     * Public key used for OCI authentication
+     */
+    publicKey: crypto.KeyObject;
+    /**
+     * User principal security token obtained from token exchange
+     */
+    upstToken: string;
+    /**
+     * Fingerprint of the public key
+     */
+    ociFingerprint: string;
+    /**
+     * OCI tenancy OCID
+     */
+    ociTenancy: string;
+    /**
+     * OCI region identifier
+     */
+    ociRegion: string;
+}
+/**
+ * Input configuration for the CLI/Action
+ */
+export interface ConfigInputs {
+    oidc_client_identifier: string;
+    domain_base_url: string;
+    oci_tenancy: string;
+    oci_region: string;
+}
+/**
+ * Response from token exchange operation
+ */
+export interface UpstTokenResponse {
+    /**
+     * The exchanged UPST token
+     */
+    token: string;
+}
+/**
+ * Custom error class for token exchange errors
+ */
+export declare class TokenExchangeError extends Error {
+    readonly cause?: unknown | undefined;
+    /**
+     * Creates a new TokenExchangeError
+     * @param message Error message
+     * @param cause Underlying cause of the error
+     */
+    constructor(message: string, cause?: unknown | undefined);
+}

package/dist/types.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenExchangeError = void 0;
+/**
+ * Custom error class for token exchange errors
+ */
+class TokenExchangeError extends Error {
+    /**
+     * Creates a new TokenExchangeError
+     * @param message Error message
+     * @param cause Underlying cause of the error
+     */
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = 'TokenExchangeError';
+    }
+}
+exports.TokenExchangeError = TokenExchangeError;

package/package.json

@@ -0,0 +1,110 @@
+{
+    "name": "@gtrevorrow/oci-token-exchange",
+    "description": "OCI Usder Principal Token Exchange for GitHub Actions, GitLab CI, and Bitbucket Pipelines",
+    "version": "1.0.0-20250417-beta",
+    "author": {
+        "name": "Oracle Cloud Infrastructure",
+        "email": "gordon.trevorrow@oracle.com"
+    },
+    "private": false,
+    "homepage": "https://github.com/gtrevorrow/oci-token-exchange-action/blob/README.md",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/gtrevorrow/oci-token-exchange-action.git"
+    },
+    "bugs": {
+        "url": "https://github.com/gtrevorrow/oci-token-exchange-action/issues"
+    },
+    "keywords": [
+        "github",
+        "actions",
+        "oracle-cloud",
+        "oracle-cloud-infrastructure"
+    ],
+    "exports": {
+        ".": "./dist/main.js"
+    },
+    "bin": {
+        "oci-token-exchange": "./dist/cli.js"
+    },
+    "engines": {
+        "node": ">=20"
+    },
+    "scripts": {
+        "build": "tsc",
+        "bundle": "npm run format:write && npm run package",
+        "format:write": "npx prettier --write .",
+        "format:check": "npx prettier --check .",
+        "lint": "npx eslint . -c ./.github/linters/.eslintrc.yml",
+        "package": "npx ncc build src/index.ts -o dist --source-map --license LICENSE.txt",
+        "all": "npm run format:write && npm run lint && npm run package",
+        "test": "jest",
+        "build:cli": "tsc && chmod +x dist/cli.js",
+        "package:cli": "npm run build:cli && npm pack",
+        "prepare": "husky install",
+        "release": "semantic-release",
+        "commit": "cz"
+    },
+    "files": [
+        "dist",
+        "LICENSE.txt",
+        "README.md"
+    ],
+    "license": "UPL-1.0",
+    "dependencies": {
+        "@actions/core": "^1.11.1",
+        "@actions/exec": "^1.1.1",
+        "@actions/github": "^6.0.0",
+        "@actions/io": "^1.1.3",
+        "@actions/tool-cache": "^2.0.2",
+        "axios": "^1.8.4"
+    },
+    "devDependencies": {
+        "@commitlint/cli": "^19.8.0",
+        "@commitlint/config-conventional": "^19.8.0",
+        "@semantic-release/changelog": "^6.0.3",
+        "@semantic-release/git": "^10.0.1",
+        "@types/jest": "^29.5.13",
+        "@types/node": "^20.17.11",
+        "@typescript-eslint/eslint-plugin": "^7.18.0",
+        "@typescript-eslint/parser": "^7.18.0",
+        "@vercel/ncc": "^0.38.1",
+        "commitizen": "^4.3.0",
+        "cz-conventional-changelog": "^3.3.0",
+        "eslint": "^8.57.1",
+        "eslint-config-prettier": "^9.1.0",
+        "eslint-plugin-prettier": "^5.2.1",
+        "husky": "^8.0.0",
+        "jest": "^29.7.0",
+        "list": "^2.0.19",
+        "npm": "^11.0.0",
+        "prettier": "^3.3.3",
+        "prettier-eslint": "^16.3.0",
+        "semantic-release": "^22.0.0",
+        "test-jest": "^1.0.1",
+        "ts-jest": "^29.2.5",
+        "typescript": "^5.8.2",
+        "typescript-eslint": "^8.1.0"
+    },
+    "publishConfig": {
+        "access": "public"
+    },
+    "release": {
+        "branches": [
+            "main"
+        ],
+        "plugins": [
+            "@semantic-release/commit-analyzer",
+            "@semantic-release/release-notes-generator",
+            "@semantic-release/changelog",
+            "@semantic-release/npm",
+            "@semantic-release/github",
+            "@semantic-release/git"
+        ]
+    },
+    "config": {
+        "commitizen": {
+            "path": "cz-conventional-changelog"
+        }
+    }
+}