(feat) implement GitHub OIDC token handling and workflow registration

Author: paoloanzn

cli/src/index.ts

@@ -1,16 +1,48 @@
 import { Command } from "commander";
-import { createWalletClient, createPublicClient, http, parseAbiItem } from "viem";
+import { createWalletClient, createPublicClient, http, parseAbiItem, toHex } from "viem";
 import type { Abi } from "viem";
 import { privateKeyToAccount } from "viem/accounts";
 import { sepolia, foundry } from "viem/chains";
 import { importAbi } from "@/importAbi.js";
 import packageJson from "../package.json" with { type: "json" };
 import { exit } from "node:process";
-import { parseJwt } from "./oidc.js";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { b64urlToHex, jwtKid, parseJwt } from "./oidc.js";
 
 const COMMAND_NAME = "fcf";
 const COMMAND_DESCRIPTION = "FCF CLI tool."
 const VERSION = packageJson?.version || "v0.0.1";
+const GITHUB_ISSUER = "https://token.actions.githubusercontent.com";
+const REGISTER_WORKFLOW_PATH = ".github/workflows/fcf-register.yml";
+const REGISTER_WORKFLOW = `name: Register Repository
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  register:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+
+      - name: Register repository
+        env:
+          PRIVATE_KEY: \${{ secrets.FCF_PRIVATE_KEY }}
+          RPC_URL: \${{ vars.FCF_RPC_URL }}
+          FCF_CONTRACT: \${{ vars.FCF_CONTRACT }}
+        run: |
+          npx --yes @freecodexyz/cli register \\
+            --contract "$FCF_CONTRACT"
+`;
 
 function die(err: any): never {
     let error = "unknown error";
@@ -51,17 +83,54 @@ function clients() {
 
 }
 
+async function requestGithubOidcToken(audience: string): Promise<string> {
+    const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
+    const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+    if (!requestUrl || !requestToken) die(new Error("GitHub OIDC env vars not found"));
+
+    const separator = requestUrl.includes("?") ? "&" : "?";
+    // include aud in payload -> aud == eth address of signer
+    const res = await fetch(`${requestUrl}${separator}audience=${encodeURIComponent(audience)}`, {
+        headers: { authorization: `bearer ${requestToken}` },
+    });
+    if (!res.ok) die(new Error(`failed to fetch GitHub OIDC token: ${res.status}`));
+
+    const body = await res.json() as { value?: string };
+    if (!body.value) die(new Error("GitHub OIDC response did not contain token"));
+    return body.value;
+}
+
+async function fetchJson(url: string): Promise<any> {
+    const res = await fetch(url);
+    if (!res.ok) die(new Error(`request failed: ${url} (${res.status})`));
+    return res.json();
+}
+
+program
+    .command("init")
+    .option("--force", "overwrite existing workflow")
+    .action((opts) => {
+        if (existsSync(REGISTER_WORKFLOW_PATH) && !opts.force) {
+            die(new Error(`${REGISTER_WORKFLOW_PATH} already exists`));
+        }
+
+        mkdirSync(dirname(REGISTER_WORKFLOW_PATH), { recursive: true });
+        writeFileSync(REGISTER_WORKFLOW_PATH, REGISTER_WORKFLOW);
+        console.log(`created: ${REGISTER_WORKFLOW_PATH}`);
+    });
+
 program
     .command("register")
-    .requiredOption("--oidcToken <token>", "GitHub's OIDC repository token")
+    .option("--oidc-token <token>", "GitHub's OIDC repository token")
     // needs to be removed in prod or be a default
     .requiredOption("--contract <addr>", "deployed RIK address")
     .action(async (opts) => {
         const { wallet, publicC, account } = clients();
+        const oidcToken = opts.oidcToken ?? await requestGithubOidcToken(account.address.toLowerCase());
 
         const jwt = (() => {
             try {
-                return parseJwt(opts.oidcToken);
+                return parseJwt(oidcToken);
             } catch(err) {
                 die(err);
             }
@@ -73,18 +142,52 @@ program
         }
         const repoId = BigInt(jwt.payload.repository_id);
         const ownerId = BigInt(jwt.payload.repository_owner_id);
+        if (!jwt.header.kid) die(new Error("jwt kid missing"));
 
         const hash = await wallet.writeContract({
             address: opts.contract as `0x${string}`,
             abi,
             functionName: "register",
-            args: [repoId, ownerId],
+            args: [
+                jwtKid(jwt.header.kid),
+                toHex(jwt.headerB64),
+                toHex(jwt.payloadB64),
+                b64urlToHex(jwt.signatureB64),
+                repoId,
+                ownerId,
+            ],
             account,
         });
         const r = await publicC.waitForTransactionReceipt({ hash });
         console.log(`registered: ${hash} status=${r.status}`);
     });
 
+program
+    .command("keys")
+    .command("sync")
+    // needs to be removed in prod or be a default
+    .requiredOption("--contract <addr>", "deployed RIK address")
+    .action(async (opts) => {
+        const { wallet, publicC, account } = clients();
+        const config = await fetchJson(`${GITHUB_ISSUER}/.well-known/openid-configuration`);
+        const jwks = await fetchJson(config.jwks_uri);
+
+        for (const key of jwks.keys ?? []) {
+            if (key.kty !== "RSA" || !key.kid || !key.n || !key.e) continue;
+
+            const kid = jwtKid(key.kid);
+            const hash = await wallet.writeContract({
+                address: opts.contract as `0x${string}`,
+                abi,
+                functionName: "addKey",
+                args: [kid, b64urlToHex(key.n), b64urlToHex(key.e)],
+                account,
+            });
+            const r = await publicC.waitForTransactionReceipt({ hash });
+            console.log(`key synced: ${key.kid} kid=${kid} status=${r.status}`);
+        }
+    });
+
 program
     .command("list")
     // needs to be removed in prod or be a default
@@ -107,4 +210,4 @@ program
         }
     });
 
-program.parseAsync(process.argv);
+program.parseAsync(process.argv);

cli/src/oidc.ts

@@ -1,17 +1,29 @@
+import { keccak256 } from "viem";
+
 function b64urlDecode(s: string): Buffer {
     s = s.replace(/-/g, "+").replace(/_/g, "/");
     while (s.length % 4) s += "=";
     return Buffer.from(s, "base64");
 }
 
+export function b64urlToHex(s: string): `0x${string}` {
+    return `0x${b64urlDecode(s).toString("hex")}`;
+}
+
+export function jwtKid(kid: string): `0x${string}` {
+    return keccak256(Buffer.from(kid, "utf8"));
+}
+
 export type JwtParts = {
     headerB64: string; payloadB64: string; signatureB64: string;
+    header: any;
     payload: any;
 }
 
 export function parseJwt(jwt: string): JwtParts {
     const [headerB64, payloadB64, signatureB64] = jwt.split(".");
     if (!payloadB64 || !headerB64 || !signatureB64) throw Error("Failed to decode jwt");
+    const header = JSON.parse(b64urlDecode(headerB64).toString("utf-8"));
     const payload = JSON.parse(b64urlDecode(payloadB64).toString("utf-8"));
-    return { headerB64, payloadB64, signatureB64, payload };
-}
+    return { headerB64, payloadB64, signatureB64, header, payload };
+}

cli/test/oidc.test.ts

@@ -1,13 +1,17 @@
 import { test, expect } from "vitest";
-import { parseJwt } from "@/oidc.js";
+import { b64urlToHex, jwtKid, parseJwt } from "@/oidc.js";
 
 test("parses GitHub OIDC payload", () => {
     // real (but expired) token
-    const jwt = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IjB0WVZjTSJ9" +
+    const jwt = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImtpZC0wMDEifQ" +
                 ".eyJyZXBvc2l0b3J5X2lkIjoiMTIzNDUiLCJyZXBvc2l0b3J5X293bmV" +
-                "yX2lkIjoiOTk5IiwiYXVkIjoiMHhmMzlmIn0.AAAA";
+                "yX2lkIjoiOTk5IiwiYXVkIjoiMHhmMzlmIn0.AAEC";
 
-    const p = parseJwt(jwt).payload;
+    const jwt_ = parseJwt(jwt);
+    const p = jwt_.payload;
+    expect(jwt_.header.kid).toBe("kid-001");
     expect(p.repository_id).toBe("12345");
     expect(p.repository_owner_id).toBe("999");
-});
+    expect(b64urlToHex(jwt_.signatureB64)).toBe("0x000102");
+    expect(jwtKid(jwt_.header.kid)).toMatch(/^0x[0-9a-f]{64}$/);
+});