action.yml

name: 'Claude Code OAuth Login'
description: 'Authenticate with Claude Code using OAuth 2.0 flow'
author: 'Guillaume Raille <guillaume.raille@gmail.com>'
branding:
  icon: 'log-in'
  color: 'orange'

permissions:
  actions: write  # Required for cache management (create/delete cache entries)
  contents: read  # Required for basic repository access

inputs:
  code:
    description: 'Authorization code from Claude (leave empty for step 1)'
    required: false
    default: ''
  secrets_admin_pat:
    description: 'Personal Access Token with secrets:write permission'
    required: false
    default: ''

outputs:
  success:
    description: 'Whether the OAuth login was successful'
    value: ${{ steps.oauth.outputs.success }}
  expires_at:
    description: 'Token expiration timestamp (milliseconds)'
    value: ${{ steps.oauth.outputs.expires_at }}

runs:
  using: 'composite'
  steps:
    - name: Setup Bun
      uses: oven-sh/setup-bun@v2
      with:
        bun-version: 1.2.17

    - name: Install Dependencies
      shell: bash
      run: |
        cd ${GITHUB_ACTION_PATH}
        bun install

    - name: Restore OAuth State
      uses: actions/cache/restore@v4
      with:
        path: ${{ github.action_path }}/claude_oauth_state.json
        key: claude-oauth-state


    - name: Run OAuth Flow
      id: oauth
      env:
        MASK_CODE: ${{ inputs.code != '' && '***REDACTED***' || 'Not provided' }}
      shell: bash
      run: |
        cd ${GITHUB_ACTION_PATH}
        if [ -z "${{ inputs.code }}" ]; then
          echo "🔗 Generating OAuth Login URL..."
          
          # Clear any existing state file from cache
          rm -f claude_oauth_state.json
          
          # Generate the login URL
          LOGIN_URL=$(bun run index.ts)
          
          # Create a GitHub Step Summary
          echo "" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "╔══════════════════════════════════════════════════════════════════════════╗" >> $GITHUB_STEP_SUMMARY
          echo "║                                                                          ║" >> $GITHUB_STEP_SUMMARY
          echo "║                        ✨ Claude OAuth Login ✨                          ║" >> $GITHUB_STEP_SUMMARY
          echo "║                                                                          ║" >> $GITHUB_STEP_SUMMARY
          echo "╚══════════════════════════════════════════════════════════════════════════╝" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "      ░██████╗ ░██╗      ░█████╗   ░██╗   ░██╗ ░██████╗░ ░███████░" >> $GITHUB_STEP_SUMMARY
          echo "     ██╔═════╝ ░██║     ░██╔══██═╗ ░██║   ░██║ ░██╔══██╗ ░██╔═══╝" >> $GITHUB_STEP_SUMMARY
          echo "     ██║       ░██║     ░███████ ║ ░██║   ░██║ ░██║░░██║ ░█████╗░" >> $GITHUB_STEP_SUMMARY
          echo "     ██║       ░██║     ░██ ╔═██ ║ ░██║   ░██║ ░██║░░██║ ░██╔══╝" >> $GITHUB_STEP_SUMMARY
          echo "     ╚██████═╗ ░███████╗░██ ║░██ ║ ░╚██████ ╔╝ ░██████╔╝ ░███████╗" >> $GITHUB_STEP_SUMMARY
          echo "      ░╚═════╝  ░╚═════╝░ ╚═╝░░╚═╝  ░╚══════╝  ░╚═════╝  ░╚══════╝" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "     ░██╗      ░██████╗   ░██████╗  ░██╗ ░███╗   ░██╗" >> $GITHUB_STEP_SUMMARY
          echo "     ░██║     ░██╔═══██╗ ░██╔════╝  ░██║ ░████╗  ░██║" >> $GITHUB_STEP_SUMMARY
          echo "     ░██║     ░██║  ░██║ ░██║  ███╗ ░██║ ░██╔██╗ ░██║" >> $GITHUB_STEP_SUMMARY
          echo "     ░██║     ░██║  ░██║ ░██║  ░██║ ░██║ ░██║╚██╗░██║" >> $GITHUB_STEP_SUMMARY
          echo "     ░███████╗░╚██████╔╝ ░╚██████╔╝ ░██║ ░██║ ░╚████║" >> $GITHUB_STEP_SUMMARY
          echo "     ░╚══════╝ ░╚═════╝   ░╚═════╝  ░╚═╝ ░╚═╝  ░╚═══╝" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "     by @grll" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "   ─────────────────────────────────────────────────────────────────────" >> $GITHUB_STEP_SUMMARY
          echo "                       【 STEP 1: Generate Login URL 】" >> $GITHUB_STEP_SUMMARY
          echo "   ─────────────────────────────────────────────────────────────────────" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "## 🚀 OAuth URL Generated Successfully!" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### 🌐 Your Login URL" >> $GITHUB_STEP_SUMMARY
          echo "[$LOGIN_URL]($LOGIN_URL)" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### 📋 Next Steps" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Step | Action | Description |" >> $GITHUB_STEP_SUMMARY
          echo "|------|--------|-------------|" >> $GITHUB_STEP_SUMMARY
          echo "| 1️⃣ | **Click URL** | Open the login URL above in your browser |" >> $GITHUB_STEP_SUMMARY
          echo "| 2️⃣ | **Sign In** | Authenticate with Claude and authorize the application |" >> $GITHUB_STEP_SUMMARY
          echo "| 3️⃣ | **Copy Code** | From the callback URL: \`https://console.anthropic.com/oauth/code/callback?code=YOUR_CODE\` |" >> $GITHUB_STEP_SUMMARY
          echo "| 4️⃣ | **Run Step 2** | Come back here and run the workflow again with your code |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### 🔄 Ready for Step 2!" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "> **Next:** Go to **Actions** → **Claude Code OAuth Login** → **Run workflow**" >> $GITHUB_STEP_SUMMARY
          echo "> Paste your authorization code in the \`code\` input field and click **Run workflow**" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "---" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "┌─────────────────────────────────────────────────────────────────────┐" >> $GITHUB_STEP_SUMMARY
          echo "│                    🎯 STEP 1 COMPLETE - AWAITING CODE               │" >> $GITHUB_STEP_SUMMARY
          echo "└─────────────────────────────────────────────────────────────────────┘" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          
          echo "✅ Step 1 Complete - Login URL generated and displayed in summary"
          echo "success=pending" >> $GITHUB_OUTPUT
        else
          echo "🔐 Exchanging authorization code for tokens..."
          
          # Clear any existing credentials file from cache
          rm -f credentials.json
          
          # Exchange the code for tokens and capture outputs
          if bun run index.ts "${{ inputs.code }}"; then
            # Success case
            echo "" >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            echo "╔══════════════════════════════════════════════════════════════════════════╗" >> $GITHUB_STEP_SUMMARY
            echo "║                                                                          ║" >> $GITHUB_STEP_SUMMARY
            echo "║                        ✨ Claude OAuth Login ✨                          ║" >> $GITHUB_STEP_SUMMARY
            echo "║                                                                          ║" >> $GITHUB_STEP_SUMMARY
            echo "╚══════════════════════════════════════════════════════════════════════════╝" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "      ░██████╗ ░██╗      ░█████╗   ░██╗   ░██╗ ░██████╗░ ░███████░" >> $GITHUB_STEP_SUMMARY
            echo "     ██╔═════╝ ░██║     ░██╔══██═╗ ░██║   ░██║ ░██╔══██╗ ░██╔═══╝" >> $GITHUB_STEP_SUMMARY
            echo "     ██║       ░██║     ░███████ ║ ░██║   ░██║ ░██║░░██║ ░█████╗░" >> $GITHUB_STEP_SUMMARY
            echo "     ██║       ░██║     ░██ ╔═██ ║ ░██║   ░██║ ░██║░░██║ ░██╔══╝" >> $GITHUB_STEP_SUMMARY
            echo "     ╚██████═╗ ░███████╗░██ ║░██ ║ ░╚██████ ╔╝ ░██████╔╝ ░███████╗" >> $GITHUB_STEP_SUMMARY
            echo "      ░╚═════╝  ░╚═════╝░ ╚═╝░░╚═╝  ░╚══════╝  ░╚═════╝  ░╚══════╝" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "     ░██╗      ░██████╗   ░██████╗  ░██╗ ░███╗   ░██╗" >> $GITHUB_STEP_SUMMARY
            echo "     ░██║     ░██╔═══██╗ ░██╔════╝  ░██║ ░████╗  ░██║" >> $GITHUB_STEP_SUMMARY
            echo "     ░██║     ░██║  ░██║ ░██║  ███╗ ░██║ ░██╔██╗ ░██║" >> $GITHUB_STEP_SUMMARY
            echo "     ░██║     ░██║  ░██║ ░██║  ░██║ ░██║ ░██║╚██╗░██║" >> $GITHUB_STEP_SUMMARY
            echo "     ░███████╗░╚██████╔╝ ░╚██████╔╝ ░██║ ░██║ ░╚████║" >> $GITHUB_STEP_SUMMARY
            echo "     ░╚══════╝ ░╚═════╝   ░╚═════╝  ░╚═╝ ░╚═╝  ░╚═══╝" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "     by @grll" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "   ─────────────────────────────────────────────────────────────────────" >> $GITHUB_STEP_SUMMARY
            echo "                         【 STEP 2: OAuth Complete! 】" >> $GITHUB_STEP_SUMMARY
            echo "   ─────────────────────────────────────────────────────────────────────" >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "## 🎉 Authentication Successful!" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### ✅ OAuth Flow Complete" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "Your Claude Code credentials have been successfully generated and saved!" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### 🔐 Stored as GitHub Secrets" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "The following secrets have been created/updated in your repository:" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "| Secret Name | Description |" >> $GITHUB_STEP_SUMMARY
            echo "|-------------|-------------|" >> $GITHUB_STEP_SUMMARY
            echo "| \`CLAUDE_ACCESS_TOKEN\` | OAuth access token for Claude API |" >> $GITHUB_STEP_SUMMARY
            echo "| \`CLAUDE_REFRESH_TOKEN\` | OAuth refresh token for token renewal |" >> $GITHUB_STEP_SUMMARY
            echo "| \`CLAUDE_EXPIRES_AT\` | Token expiration timestamp (milliseconds) |" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### 📁 Generated Files" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "| File | Description | Status |" >> $GITHUB_STEP_SUMMARY
            echo "|------|-------------|--------|" >> $GITHUB_STEP_SUMMARY
            echo "| \`credentials.json\` | OAuth tokens (local file) | ✅ Created |" >> $GITHUB_STEP_SUMMARY
            echo "| \`claude_oauth_state.json\` | Temporary state file | 🗑️ Cleaned up |" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### 🚀 What's Next?" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "You can now use these secrets in your workflows:" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "[see example workflow](https://github.com/${{ github.repository }}#using-the-oauth-credentials)"
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "---" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            echo "┌─────────────────────────────────────────────────────────────────────┐" >> $GITHUB_STEP_SUMMARY
            echo "│                       🎯 AUTHENTICATION COMPLETE!                   │" >> $GITHUB_STEP_SUMMARY
            echo "│                         Ready to use Claude Code                    │" >> $GITHUB_STEP_SUMMARY
            echo "└─────────────────────────────────────────────────────────────────────┘" >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            
            echo "✅ Step 2 Complete - OAuth authentication successful!"
            echo "success=true" >> $GITHUB_OUTPUT
            
            # Extract token values from credentials.json
            ACCESS_TOKEN=$(jq -r '.claudeAiOauth.accessToken' credentials.json)
            REFRESH_TOKEN=$(jq -r '.claudeAiOauth.refreshToken' credentials.json)
            EXPIRES_AT=$(jq -r '.claudeAiOauth.expiresAt' credentials.json)
            
            # Store tokens as GitHub secrets using PAT
            if [ -z "${{ inputs.secrets_admin_pat }}" ]; then
              echo "❌ Error: SECRETS_ADMIN_PAT is not configured!"
              echo ""
              echo "This action requires a Personal Access Token to securely store the OAuth tokens as GitHub secrets."
              echo "Please follow the setup instructions in the README.md to create and configure SECRETS_ADMIN_PAT."
              echo ""
              echo "See: https://github.com/${{ github.repository }}#prerequisites-setting-up-secrets_admin_pat"
              exit 1
            fi

            export GH_TOKEN="${{ inputs.secrets_admin_pat }}"
            echo "$ACCESS_TOKEN" | gh secret set CLAUDE_ACCESS_TOKEN --repo ${{ github.repository }}
            echo "$REFRESH_TOKEN" | gh secret set CLAUDE_REFRESH_TOKEN --repo ${{ github.repository }}
            echo "$EXPIRES_AT" | gh secret set CLAUDE_EXPIRES_AT --repo ${{ github.repository }}
            echo "✅ Tokens stored as GitHub secrets!"
          else
            # Failure case
            echo "" >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            echo "╔══════════════════════════════════════════════════════════════════════════╗" >> $GITHUB_STEP_SUMMARY
            echo "║                                                                          ║" >> $GITHUB_STEP_SUMMARY
            echo "║                        ✨ Claude OAuth Login ✨                          ║" >> $GITHUB_STEP_SUMMARY
            echo "║                                                                          ║" >> $GITHUB_STEP_SUMMARY
            echo "╚══════════════════════════════════════════════════════════════════════════╝" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "      ░██████╗ ░██╗      ░█████╗   ░██╗   ░██╗ ░██████╗░ ░███████░" >> $GITHUB_STEP_SUMMARY
            echo "     ██╔═════╝ ░██║     ░██╔══██═╗ ░██║   ░██║ ░██╔══██╗ ░██╔═══╝" >> $GITHUB_STEP_SUMMARY
            echo "     ██║       ░██║     ░███████ ║ ░██║   ░██║ ░██║░░██║ ░█████╗░" >> $GITHUB_STEP_SUMMARY
            echo "     ██║       ░██║     ░██ ╔═██ ║ ░██║   ░██║ ░██║░░██║ ░██╔══╝" >> $GITHUB_STEP_SUMMARY
            echo "     ╚██████═╗ ░███████╗░██ ║░██ ║ ░╚██████ ╔╝ ░██████╔╝ ░███████╗" >> $GITHUB_STEP_SUMMARY
            echo "      ░╚═════╝  ░╚═════╝░ ╚═╝░░╚═╝  ░╚══════╝  ░╚═════╝  ░╚══════╝" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "     ░██╗      ░██████╗   ░██████╗  ░██╗ ░███╗   ░██╗" >> $GITHUB_STEP_SUMMARY
            echo "     ░██║     ░██╔═══██╗ ░██╔════╝  ░██║ ░████╗  ░██║" >> $GITHUB_STEP_SUMMARY
            echo "     ░██║     ░██║  ░██║ ░██║  ███╗ ░██║ ░██╔██╗ ░██║" >> $GITHUB_STEP_SUMMARY
            echo "     ░██║     ░██║  ░██║ ░██║  ░██║ ░██║ ░██║╚██╗░██║" >> $GITHUB_STEP_SUMMARY
            echo "     ░███████╗░╚██████╔╝ ░╚██████╔╝ ░██║ ░██║ ░╚████║" >> $GITHUB_STEP_SUMMARY
            echo "     ░╚══════╝ ░╚═════╝   ░╚═════╝  ░╚═╝ ░╚═╝  ░╚═══╝" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "     by @grll" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "   ─────────────────────────────────────────────────────────────────────" >> $GITHUB_STEP_SUMMARY
            echo "                       【 STEP 2: Authentication Failed 】" >> $GITHUB_STEP_SUMMARY
            echo "   ─────────────────────────────────────────────────────────────────────" >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "## ❌ Authentication Failed" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### 🔍 Possible Issues" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "| Issue | Solution |" >> $GITHUB_STEP_SUMMARY
            echo "|-------|----------|" >> $GITHUB_STEP_SUMMARY
            echo "| **Expired State** | Run Step 1 again to generate a new login URL |" >> $GITHUB_STEP_SUMMARY
            echo "| **Invalid Code** | Double-check the authorization code from the callback URL |" >> $GITHUB_STEP_SUMMARY
            echo "| **Network Error** | Check your internet connection and try again |" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "### 🔄 Try Again" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "1. Go back to **Actions** → **Claude Code OAuth Login** → **Run workflow**" >> $GITHUB_STEP_SUMMARY
            echo "2. Leave the \`code\` field **empty** to restart from Step 1" >> $GITHUB_STEP_SUMMARY
            echo "3. Follow the authentication flow again" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "---" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            echo "┌─────────────────────────────────────────────────────────────────────┐" >> $GITHUB_STEP_SUMMARY
            echo "│                     ⚠️  AUTHENTICATION FAILED                       │" >> $GITHUB_STEP_SUMMARY
            echo "│                        Please try again                             │" >> $GITHUB_STEP_SUMMARY
            echo "└─────────────────────────────────────────────────────────────────────┘" >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            
            echo "❌ Step 2 Failed - Please check the summary for troubleshooting steps"
            echo "success=false" >> $GITHUB_OUTPUT
          fi
        fi


    - name: Delete Old OAuth State Cache
      shell: bash
      run: |
        if gh cache list --repo ${{ github.repository }} --key claude-oauth-state | grep -q claude-oauth-state; then
          gh cache delete claude-oauth-state --repo ${{ github.repository }}
        fi
      env:
        GITHUB_TOKEN: ${{ github.token }}

    - name: Save OAuth State
      if: inputs.code == ''
      uses: actions/cache/save@v4
      with:
        path: ${{ github.action_path }}/claude_oauth_state.json
        key: claude-oauth-state