fetch-forgejo-jwt/action.yml

name: fetch-forgejo-jwt
description: Fetch a Forgejo Open ID Connect (OIDC) JSON web token (JWT) for a particular authorized integration and provide it for reuse. This action required Forgejo v16 or later.

inputs:
  audience:
    required: true
    description: Unique audience claim (`aud`) for the authorized integration. See the official Authorized Integrations documentation at https://forgejo.org/docs/latest/user/api/authorized-integrations/ for how to register and obtain this value.

outputs:
  jwt:
    description: Fetched JWT
    value: ${{ steps.fetch.outputs.jwt }}

runs:
  using: composite
  steps:
    - name: Fetch JWT
      id: fetch
      shell: bash
      env:
        AUD: ${{ inputs.audience }}
      run: |
        json=$(curl --silent --fail \
          -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
          "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=$AUD")

        # avoid heavy jq dependency and go with simple bash features
        jwt=${json#*'"value":"'}
        jwt=${jwt%%'"'*}

        echo "::add-mask::$jwt"
        echo "jwt=$jwt" >> "$FORGEJO_OUTPUT"