GitHub Apps の Access Token を取得するGoogle Apps Script 用ライブラリーを作った

/**
 * jwt の要素(?)用にエンコードする.
 * @param {string | any[]} s - ソース.
 */
function encodeItem_(s) {
  if (Array.isArray(s)) {
    return Utilities.base64Encode(s)
  }
  return Utilities.base64Encode(JSON.stringify(s))
}

/**
 * リクエスト用の jwt を生成.
 * @param {string} appId - App Id
 * @param {string} key - private key(RSA key は扱えない)
 */
function jwtToken_(appId, key) {
  const payload = {
    exp: Math.floor(Date.now() / 1000) + 60,  // JWT expiration time
    // ちょっとだけ時間を手前にしておくとアクセストークンの発行に失敗し辛いらしい。
    // https://qiita.com/icoxfog417/items/fe411b94b8e7ae229e3e#github-apps%E3%81%AE%E8%AA%8D%E8%A8%BC
    iat: Math.floor(Date.now() / 1000) - 10,       // Issued at time 
    iss: appId
  }
  const header = {
    'alg': 'RS256',
    'typ': 'JWT'
  };

  const src = `${encodeItem_(header)}.${encodeItem_(payload)}`
  const signed = Utilities.computeRsaSha256Signature(src, key)
  return `${src}.${encodeItem_(signed)}`
}

/**
 * Application Token を取得する.
 * @param {string} appId - App Id
 * @param {string} installationId - Installation Id
 * @param {string} key - private key(RSA key は扱えない)
 */
function ghToken(appId, installationId, key) {
  const t = jwtToken_(appId, key)
  try {
    const api_url = 'https://api.github.com'
    const path = `/app/installations/${installationId}/access_tokens`
    const res = UrlFetchApp.fetch(`${api_url}${path}`, {
      method: 'post',
      "headers": {
        Authorization: `Bearer ${t}`,
        Accept: "application/vnd.github.machine-man-preview+json"
      }, muteHttpExceptions: true
    })
    return res.getContentText()
  } catch (e) {
    console.error(e)
  }
}

function main() {
  const props = PropertiesService.getScriptProperties()
  const appId = props.getProperty('appId')
  const installationId = props.getProperty('installationId')
  const privateKey = props.getProperty('privateKey')

  const res = JSON.parse(ghToken(appId, installationId, privateKey))
  console.log(res)

  const now = Date.now()
  const e = new Date(res.expires_at)
  console.log((e.getTime() - now) / 1000 / 60)
}

  const props = PropertiesService.getScriptProperties()
  const appId = props.getProperty('appId')
  const installationId = props.getProperty('installationId')
  const privateKey = props.getProperty('privateKey')

  const owner = props.getProperty('owner')
  const repo = props.getProperty('repo')
  const workflowId = props.getProperty('workflowId')
  const ref = props.getProperty('ref')

  const apiBaseUrl = 'https://api.github.com'

  const [url, opts] = GitHubAppToken.generate({
    appId,
    installationId,
    privateKey,
  })

  const res = UrlFetchApp.fetch(url, opts)
  const token = JSON.parse(res).token

  const path = `/repos/${owner}/${repo}/actions/workflows/${workflowId}/dispatches`
  const runRes = UrlFetchApp.fetch(`${apiBaseUrl}${path}`, {
    method: 'post',
    "headers": {
      Authorization: `token ${token}`,
      Accept: "application/vnd.github.v3+json",
    },
    payload: JSON.stringify({ ref }),
  })
  console.log(runRes.getContentText())