token.sh

#!/bin/bash
# Trades the long-lived PAT for a ~1-hour runner registration token.
#
# This exists because config.sh refuses permanent credentials: it only accepts a
# short-lived registration token, so something has to mint a fresh one at every
# container start. That "something" is this file.
#
# Scope: github.com, repo-level, PAT auth. Org/enterprise scope and GitHub App
# auth are deliberately absent — see README.
set -euo pipefail

: "${ACCESS_TOKEN:?ACCESS_TOKEN required (fine-grained PAT with Administration: read & write)}"
: "${REPO_URL:?REPO_URL required (e.g. https://github.com/owner/repo)}"

# config.sh --url needs an https URL anyway, so reject anything else here rather
# than silently building a garbage API path from an ssh remote.
[[ ${REPO_URL} == https://* ]] || {
  echo "ERROR: REPO_URL must be an https:// URL, got '${REPO_URL}'" >&2
  exit 1
}

REPO_PATH="${REPO_URL#*://}"   # drop scheme  -> github.com/owner/repo
REPO_PATH="${REPO_PATH#*/}"    # drop host    -> owner/repo
REPO_PATH="${REPO_PATH%/}"     # drop trailing slash
REPO_PATH="${REPO_PATH%.git}"  # drop .git suffix

[[ ${REPO_PATH} == */* && ${REPO_PATH} != */*/* ]] || {
  echo "ERROR: REPO_URL must point at a repo (owner/repo), parsed '${REPO_PATH}'" >&2
  exit 1
}

API_URL="https://api.github.com/repos/${REPO_PATH}/actions/runners/registration-token"

# The URL-building above is the only real logic in this file; DRY_RUN makes it
# assertable by test_token.sh without a PAT or network access.
if [[ ${DRY_RUN:-} == 1 ]]; then
  echo "${API_URL}"
  exit 0
fi

curl -fsSL -X POST \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  -H "Content-Length: 0" \
  "${API_URL}" | jq -er '.token'