hot.dev/github / ::github::app

GitHub App authentication: sign an app JWT with the App's RSA private key, then mint short-lived installation tokens with it. Built on hot.dev/jwt and the ::hot::crypto RS256 natives.

Example

::app ::github::app

token ::app/installation-token(app-id, private-key-pem, installation-id)
// Tokens live ~1 hour. Set the runtime-minted secret for this run;
// every ::github wrapper then authenticates with it.
::hot::ctx/set-secret("github.token", token.token)
issues ::github::issues/list-issues("acme", "api")

Functions

app-jwt

fn (app-id: Any, private-key-pem: Str): Str

Sign a GitHub App JWT (RS256) from the App id and its PEM private key (the .pem GitHub generates — PKCS#1 BEGIN RSA PRIVATE KEY — or a PKCS#8 conversion).

build-app-claims

fn (app-id: Any): Map

Build the app JWT claims per GitHub's spec: iat 60s in the past (clock drift), exp at most 10 minutes out, iss = the App id.

installation-token

fn (app-id: Any, private-key-pem: Str, installation-id: Any): Map

POST /app/installations/{id}/access_tokens - Mint an installation access token (~1 hour). Returns {token, expires_at, permissions}. Set token.token as the github.token context variable (::hot::ctx/set-secret("github.token", token.token) for runtime-minted tokens) so the endpoint wrappers pick it up, or pass it explicitly via the final arity of ::github::api/request/json.

list-installations

fn (app-id: Any, private-key-pem: Str): Any

GET /app/installations - The installations of your App (authenticated with the app JWT).