feat(invoke-gati-v2): sync from .github-internal

[erikburt]

See: https://github.com/smartcontractkit/.github-internal/pull/117

Related

#1660 <- required for automatic rollout

[github-actions]

💥 No Changeset

Latest commit: 7bfa0e8

Merging this PR will not cause any packages to be released. If these changes should not cause updates to packages in this repo, this is fine 🙂

If these changes should be included in a release's CHANGELOG, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

You can also use gocs to generate changeset files locally.

[Copilot]

🟡 Changes recommended

There are security/operational concerns around logging raw inputs and allowing unbounded retries/insufficiently constrained URL inputs that should be addressed before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Introduces a new invoke-gati-v2 JavaScript action that exchanges a GitHub OIDC token for a scoped GitHub installation access token via the GATI v2 ingress, and revokes the token in a post step. This fits alongside the existing GATI v1 action as a separate, non-breaking action intended for future rollout via setup-github-token (#1660).

Changes:

• Added the invoke-gati-v2 action implementation (OIDC mint → token exchange → output + post-step revocation) with input parsing and profile/audience shaping.
• Added unit tests (Vitest) for input parsing, profile parsing, ingress exchange retry behavior, and token revocation behavior.
• Added CI/validation workflow coverage for v1-migration profiles and updated artifact-diff checking to include post.js.

File summaries

File	Description
pnpm-lock.yaml	Adds the actions/invoke-gati-v2 workspace dependencies/devDependencies.
actions/invoke-gati-v2/tsconfig.spec.json	TypeScript config for running specs/tests for the new action.
actions/invoke-gati-v2/tsconfig.json	Base TS compiler options for the action source.
actions/invoke-gati-v2/src/state.ts	Stores/loads the minted access token in step state for post-step revocation.
actions/invoke-gati-v2/src/run.ts	Main action entry logic: resolve profile/audience, mint OIDC, exchange for installation token, output token.
actions/invoke-gati-v2/src/run-post.ts	Post-step cleanup logic: revoke token if present, warn (don’t fail job) on revoke failure.
actions/invoke-gati-v2/src/run-inputs.ts	Reads and validates action inputs (profile, url, retries).
actions/invoke-gati-v2/src/profile.ts	Parses profile strings into structured types and renders the OIDC audience claim.
actions/invoke-gati-v2/src/post.ts	Post-step entrypoint wiring.
actions/invoke-gati-v2/src/index.ts	Main entrypoint wiring.
actions/invoke-gati-v2/src/github.ts	Implements DELETE /installation/token revocation call.
actions/invoke-gati-v2/src/gati.ts	Implements token exchange against the ingress with retry/backoff and safe response parsing.
actions/invoke-gati-v2/src/tests/run-inputs.test.ts	Unit tests for inputs reading/validation behavior.
actions/invoke-gati-v2/src/tests/profile.test.ts	Unit tests for profile parsing and audience rendering.
actions/invoke-gati-v2/src/tests/github.test.ts	Unit tests for installation token revocation call behavior.
actions/invoke-gati-v2/src/tests/gati.test.ts	Unit tests for token exchange, retry/backoff behavior, and response parsing safety.
actions/invoke-gati-v2/README.md	Documents usage, inputs/outputs, profiles, and token lifetime behavior.
actions/invoke-gati-v2/project.json	Nx project definition for building, type-checking, and testing the new action.
actions/invoke-gati-v2/package.json	Declares action package metadata, Node engine requirement, and dependencies.
actions/invoke-gati-v2/action.yml	Action metadata: inputs/outputs and node24 main+post entrypoints.
.github/workflows/pull-request-main.yml	Updates PR workflow to check both index.js and post.js built artifacts; adjusts a disabled job condition.
.github/workflows/invoke-gati-v2-validate.yml	Adds a dedicated validation workflow to exercise v1 migration profiles safely in public logs.
.changeset/plenty-donuts-count.md	Adds a changeset for versioning/release tracking of invoke-gati-v2.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 22/25 changed files
• Comments generated: 5
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.