Function getInstallationToken

shared/github/app-auth.ts:202–237

(
    creds: GithubAppCredentials,
    org: string,
)

 * used as `Authorization: token <token>` against the REST and GraphQL APIs.
 */
export async function getInstallationToken(
    creds: GithubAppCredentials,
    org: string,
): Promise<string> {
    if (cached && cached.expiresAtMs - Date.now() > REFRESH_SKEW_MS) {
        return cached.token;
    }

    const jwt = await mintAppJwt(creds);
    const installationId = await resolveInstallationId(jwt, org);

    const res = await fetch(
        `${GITHUB_API}/app/installations/${installationId}/access_tokens`,
        {
            method: "POST",
            headers: {
                Authorization: `Bearer ${jwt}`,
                Accept: "application/vnd.github+json",
                "X-GitHub-Api-Version": "2022-11-28",
                "User-Agent": USER_AGENT,
            },
        },
    );
    if (res.status !== 201) {
        throw new Error(
            `GitHub installation token mint -> ${res.status}: ${await res.text()}`,
        );
    }
    const body = (await res.json()) as { token: string; expires_at: string };
    cached = {
        token: body.token,
        expiresAtMs: new Date(body.expires_at).getTime(),
        installationId,
    };
    return cached.token;
}

/** Read App credentials off a Worker env. Throws if either is missing. */
export function githubAppCredentialsFromEnv(env: {