Fix bug when scope is repository

README.md

@@ -26,6 +26,7 @@ You will need to provide the GitHub App ID and private key. The action will then
     with:
       app_id: ${{ secrets.APP_ID }}
       private_key: ${{ secrets.APP_PRIVATE_KEY }}
+      scope: "octocat"  # Optional, you can set "org" or "org/repo"
 
   - name: Checkout private repo
     uses: actions/checkout@v2

action.yml

@@ -10,7 +10,7 @@ inputs:
     description: 'Private key for the GitHub App'
   scope:
     required: false
-    description: 'Scope of installation account'
+    description: 'Scope of installation account. Format: "org" or "org/repo"'
     default: ''
 outputs:
   token:

dist/index.js

@@ -83,10 +83,50 @@
             );
           });
         };
+      var __asyncValues =
+        (this && this.__asyncValues) ||
+        function (o) {
+          if (!Symbol.asyncIterator)
+            throw new TypeError('Symbol.asyncIterator is not defined.');
+          var m = o[Symbol.asyncIterator],
+            i;
+          return m
+            ? m.call(o)
+            : ((o =
+                typeof __values === 'function'
+                  ? __values(o)
+                  : o[Symbol.iterator]()),
+              (i = {}),
+              verb('next'),
+              verb('throw'),
+              verb('return'),
+              (i[Symbol.asyncIterator] = function () {
+                return this;
+              }),
+              i);
+          function verb(n) {
+            i[n] =
+              o[n] &&
+              function (v) {
+                return new Promise(function (resolve, reject) {
+                  (v = o[n](v)), settle(resolve, reject, v.done, v.value);
+                });
+              };
+          }
+          function settle(resolve, reject, d, v) {
+            Promise.resolve(v).then(function (v) {
+              resolve({value: v, done: d});
+            }, reject);
+          }
+        };
       Object.defineProperty(exports, '__esModule', {value: true});
       const auth_app_1 = __nccwpck_require__(7541);
       const rest_1 = __nccwpck_require__(5375);
       const core = __importStar(__nccwpck_require__(2186));
+      const plugin_paginate_rest_1 = __nccwpck_require__(4193);
+      const paginateOctokit = rest_1.Octokit.plugin(
+        plugin_paginate_rest_1.paginateRest
+      );
       function run() {
         return __awaiter(this, void 0, void 0, function* () {
           try {
@@ -104,12 +144,13 @@
             const installations = yield appOctokit.apps.listInstallations();
             let installationId = installations.data[0].id;
             if (scope !== '') {
+              const loginName = scope.split('/')[0]; // if scope set repository, loginName is username
               const scopedData = installations.data.find((item) => {
                 var _a;
                 return (
                   ((_a = item.account) === null || _a === void 0
                     ? void 0
-                    : _a.login) === scope
+                    : _a.login) === loginName
                 );
               });
               if (scopedData === undefined) {
@@ -129,16 +170,57 @@
               throw new Error('Unable to authenticate');
             }
             // @ts-expect-error
-            core.setSecret(resp.token);
-            // @ts-expect-error
-            core.setOutput('token', resp.token);
+            const installationToken = resp.token;
+            // Need to check accessibility if scope set repository
+            if (scope !== '' && scope.split('/').length === 2) {
+              yield isExistRepositoryInGitHubApps(installationToken, scope);
+            }
+            core.setSecret(installationToken);
+            core.setOutput('token', installationToken);
           } catch (error) {
             if (error instanceof Error) {
               core.setFailed(error.message);
             }
           }
         });
       }
+      function isExistRepositoryInGitHubApps(installationToken, repository) {
+        var e_1, _a;
+        return __awaiter(this, void 0, void 0, function* () {
+          const installationOctokit = new paginateOctokit({
+            auth: installationToken,
+            baseUrl: process.env.GITHUB_API_URL || 'https://api.github.com',
+          });
+          try {
+            for (
+              var _b = __asyncValues(
+                  installationOctokit.paginate.iterator(
+                    'GET /installation/repositories'
+                  )
+                ),
+                _c;
+              (_c = yield _b.next()), !_c.done;
+
+            ) {
+              const response = _c.value;
+              if (response.data.find((r) => r.full_name === repository)) {
+                return undefined;
+              }
+            }
+          } catch (e_1_1) {
+            e_1 = {error: e_1_1};
+          } finally {
+            try {
+              if (_c && !_c.done && (_a = _b.return)) yield _a.call(_b);
+            } finally {
+              if (e_1) throw e_1.error;
+            }
+          }
+          throw new Error(
+            `GitHub Apps can't accessible repository (${repository})`
+          );
+        });
+      }
       run();
 
       /***/

src/main.ts

@@ -3,6 +3,10 @@ import {Octokit} from '@octokit/rest';
 import {Endpoints} from '@octokit/types';
 import * as core from '@actions/core';
 
+import {paginateRest} from '@octokit/plugin-paginate-rest';
+
+const paginateOctokit = Octokit.plugin(paginateRest);
+
 type listInstallationsResponse =
   Endpoints['GET /app/installations']['response'];
 
@@ -24,8 +28,9 @@ async function run(): Promise<void> {
       await appOctokit.apps.listInstallations();
     let installationId = installations.data[0].id;
     if (scope !== '') {
+      const loginName: string = scope.split('/')[0]; // if scope set repository, loginName is username
       const scopedData = installations.data.find(
-        (item) => item.account?.login === scope
+        (item) => item.account?.login === loginName
       );
       if (scopedData === undefined) {
         throw new Error(`set scope is ${scope}, but installation is not found`);
@@ -43,16 +48,41 @@ async function run(): Promise<void> {
     if (!resp) {
       throw new Error('Unable to authenticate');
     }
-
-    // @ts-expect-error
-    core.setSecret(resp.token);
     // @ts-expect-error
-    core.setOutput('token', resp.token);
+    const installationToken = resp.token;
+
+    // Need to check accessibility if scope set repository
+    if (scope !== '' && scope.split('/').length === 2) {
+      await isExistRepositoryInGitHubApps(installationToken, scope);
+    }
+
+    core.setSecret(installationToken);
+    core.setOutput('token', installationToken);
   } catch (error) {
     if (error instanceof Error) {
       core.setFailed(error.message);
     }
   }
 }
 
+async function isExistRepositoryInGitHubApps(
+  installationToken: string,
+  repository: string
+): Promise<void> {
+  const installationOctokit = new paginateOctokit({
+    auth: installationToken,
+    baseUrl: process.env.GITHUB_API_URL || 'https://api.github.com',
+  });
+
+  for await (const response of installationOctokit.paginate.iterator(
+    'GET /installation/repositories'
+  )) {
+    if (response.data.find((r) => r.full_name === repository)) {
+      return undefined;
+    }
+  }
+
+  throw new Error(`GitHub Apps can't accessible repository (${repository})`);
+}
+
 run();