From 06d67ef0a78e083aed2b8c5ef48b04a88c42838c Mon Sep 17 00:00:00 2001
From: Gregor Martynus <39992+gr2m@users.noreply.github.com>
Date: Sat, 16 Dec 2023 12:11:39 -0800
Subject: [PATCH 01/15] add `github_api_url` input to `action.yml

---
 action.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/action.yml b/action.yml
index ecc31881..701a6b93 100644
--- a/action.yml
+++ b/action.yml
@@ -32,6 +32,11 @@ inputs:
     description: "If truthy, the token will not be revoked when the current job is complete"
     required: false
     deprecationMessage: "'skip_token_revoke' is deprecated and will be removed in a future version. Use 'skip-token-revoke' instead."
+  # Make GitHub API consigurable to support GitHub Enterprise server usecases
+  # see https://github.com/actions/create-github-app-token/issues/77
+  github-api-url:
+    description: The API URL of the GitHub server.
+    default: ${{ github.api_url }}
 outputs:
   token:
     description: "GitHub installation access token"

From 0152e7c69ce2fa2b1ac02bc964c857bb8f6c8b9c Mon Sep 17 00:00:00 2001
From: Gregor Martynus <39992+gr2m@users.noreply.github.com>
Date: Sat, 16 Dec 2023 12:17:17 -0800
Subject: [PATCH 02/15] docs(README): add documentation and example for
 `github-api-url`

---
 README.md | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 0e3bc2be..26435cb4 100644
--- a/README.md
+++ b/README.md
@@ -15,7 +15,11 @@ In order to use this action, you need to:
 ### Create a token for the current repository
 
 ```yaml
-on: [issues]
+name: Run tests on staging
+on:
+  push:
+    branches:
+      - main
 
 jobs:
   hello-world:
@@ -26,11 +30,10 @@ jobs:
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.PRIVATE_KEY }}
-      - uses: peter-evans/create-or-update-comment@v3
+          github-api-url: "https://github.acme-inc.com/api/v3"
+      - uses: ./actions/staging-tests
         with:
           token: ${{ steps.app-token.outputs.token }}
-          issue-number: ${{ github.event.issue.number }}
-          body: "Hello, World!"
 ```
 
 ### Use app token with `actions/checkout`
@@ -146,7 +149,7 @@ jobs:
         run: echo 'matrix=[{"owner":"owner1"},{"owner":"owner2","repos":["repo1"]}]' >>"$GITHUB_OUTPUT"
 
   use-matrix:
-    name: '@${{ matrix.owners-and-repos.owner }} installation'
+    name: "@${{ matrix.owners-and-repos.owner }} installation"
     needs: [set-matrix]
     runs-on: ubuntu-latest
     strategy:
@@ -172,6 +175,12 @@ jobs:
           MULTILINE_JSON_STRING: ${{ steps.get-installation-repositories.outputs.data }}
 ```
 
+### Run the workflow in a github.com repository against an organization in Github Enterprise.
+
+```yaml
+on: [push]
+```
+
 ## Inputs
 
 ### `app-id`
@@ -197,6 +206,10 @@ jobs:
 
 **Optional:** If truthy, the token will not be revoked when the current job is complete.
 
+### `github-api-url`
+
+**Optional:** GitHub API URL. Defaults to `https://api.github.com`.
+
 ## Outputs
 
 ### `token`

From 2810d584db1a565aad5ac505196080d390650e05 Mon Sep 17 00:00:00 2001
From: Gregor Martynus <39992+gr2m@users.noreply.github.com>
Date: Sat, 16 Dec 2023 12:28:11 -0800
Subject: [PATCH 03/15] get GitHub API base URL from input instead of
 environment variable

---
 main.js | 6 +++---
 post.js | 9 +++------
 2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/main.js b/main.js
index 61375d6f..073fabbc 100644
--- a/main.js
+++ b/main.js
@@ -31,6 +31,8 @@ const skipTokenRevoke = Boolean(
   core.getInput("skip-token-revoke") || core.getInput("skip_token_revoke")
 );
 
+const baseUrl = core.getInput("github-api-url").replace(/\/$/, "");
+
 main(
   appId,
   privateKey,
@@ -38,9 +40,7 @@ main(
   repositories,
   core,
   createAppAuth,
-  request.defaults({
-    baseUrl: process.env["GITHUB_API_URL"],
-  }),
+  request.defaults({ baseUrl }),
   skipTokenRevoke
 ).catch((error) => {
   /* c8 ignore next 3 */
diff --git a/post.js b/post.js
index 7f0fe83a..445674b8 100644
--- a/post.js
+++ b/post.js
@@ -5,12 +5,9 @@ import core from "@actions/core";
 import { post } from "./lib/post.js";
 import request from "./lib/request.js";
 
-post(
-  core,
-  request.defaults({
-    baseUrl: process.env["GITHUB_API_URL"],
-  })
-).catch((error) => {
+const baseUrl = core.getInput("github-api-url").replace(/\/$/, "");
+
+post(core, request.defaults({ baseUrl })).catch((error) => {
   /* c8 ignore next 3 */
   console.error(error);
   core.setFailed(error.message);

From f60bd02be540dcd066c8b4dfb2437a0f13a6d540 Mon Sep 17 00:00:00 2001
From: Gregor Martynus <39992+gr2m@users.noreply.github.com>
Date: Sat, 16 Dec 2023 12:32:13 -0800
Subject: [PATCH 04/15] tests still need fixing but gotta run for now

---
 .../main-token-get-owner-set-to-user-fail-response.test.js  | 6 +++---
 tests/main.js                                               | 2 ++
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/tests/main-token-get-owner-set-to-user-fail-response.test.js b/tests/main-token-get-owner-set-to-user-fail-response.test.js
index d1edf81a..8375bcee 100644
--- a/tests/main-token-get-owner-set-to-user-fail-response.test.js
+++ b/tests/main-token-get-owner-set-to-user-fail-response.test.js
@@ -2,8 +2,8 @@ import { test } from "./main.js";
 
 // Verify `main` successfully obtains a token when the `owner` input is set (to a user), but the `repositories` input isn’t set.
 await test((mockPool) => {
+  process.env.INPUT_REPOSITORIES = "smockle";
   process.env.INPUT_OWNER = "smockle";
-  delete process.env.INPUT_REPOSITORIES;
 
   // Mock installation id request
   const mockInstallationId = "123456";
@@ -17,8 +17,8 @@ await test((mockPool) => {
         // Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
       },
     })
-    .reply(500, 'GitHub API not available')
-    mockPool
+    .reply(500, "GitHub API not available");
+  mockPool
     .intercept({
       path: `/orgs/${process.env.INPUT_OWNER}/installation`,
       method: "GET",
diff --git a/tests/main.js b/tests/main.js
index 12c84379..3338cbb3 100644
--- a/tests/main.js
+++ b/tests/main.js
@@ -6,8 +6,10 @@ export async function test(cb = (_mockPool) => {}) {
   // Set required environment variables and inputs
   process.env.GITHUB_REPOSITORY_OWNER = "actions";
   process.env.GITHUB_REPOSITORY = "actions/create-github-app-token";
+
   // inputs are set as environment variables with the prefix INPUT_
   // https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#example-specifying-inputs
+  process.env["INPUT_GITHUB-API-URL"] = "https://api.github.com";
   process.env["INPUT_APP-ID"] = "123456";
   process.env["INPUT_PRIVATE-KEY"] = `-----BEGIN RSA PRIVATE KEY-----
 MIIEowIBAAKCAQEA280nfuUM9w00Ib9E2rvZJ6Qu3Ua3IqR34ZlK53vn/Iobn2EL

From ca42fb1908475393527e8e581bf70fb5148d5627 Mon Sep 17 00:00:00 2001
From: Gregor Martynus <39992+gr2m@users.noreply.github.com>
Date: Tue, 19 Dec 2023 11:12:41 -0800
Subject: [PATCH 05/15] Apply suggestions from code review

Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
---
 README.md  | 4 ++--
 action.yml | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 26435cb4..f7ec8d14 100644
--- a/README.md
+++ b/README.md
@@ -175,7 +175,7 @@ jobs:
           MULTILINE_JSON_STRING: ${{ steps.get-installation-repositories.outputs.data }}
 ```
 
-### Run the workflow in a github.com repository against an organization in Github Enterprise.
+### Run the workflow in a github.com repository against an organization in GitHub Enterprise Server
 
 ```yaml
 on: [push]
@@ -208,7 +208,7 @@ on: [push]
 
 ### `github-api-url`
 
-**Optional:** GitHub API URL. Defaults to `https://api.github.com`.
+**Optional:** The URL of the GitHub REST API. Defaults to the URL of the GitHub Rest API where the workflow is run from.
 
 ## Outputs
 
diff --git a/action.yml b/action.yml
index 701a6b93..e150b717 100644
--- a/action.yml
+++ b/action.yml
@@ -32,10 +32,10 @@ inputs:
     description: "If truthy, the token will not be revoked when the current job is complete"
     required: false
     deprecationMessage: "'skip_token_revoke' is deprecated and will be removed in a future version. Use 'skip-token-revoke' instead."
-  # Make GitHub API consigurable to support GitHub Enterprise server usecases
+  # Make GitHub API configurable to support non-GitHub Cloud use cases
   # see https://github.com/actions/create-github-app-token/issues/77
   github-api-url:
-    description: The API URL of the GitHub server.
+    description: The URL of the GitHub REST API.
     default: ${{ github.api_url }}
 outputs:
   token:

From ab075fc3599d9860cee77356afe7cb37c17b8b12 Mon Sep 17 00:00:00 2001
From: Gregor Martynus <39992+gr2m@users.noreply.github.com>
Date: Tue, 23 Jan 2024 14:19:08 -0800
Subject: [PATCH 06/15] build: update dist files

---
 dist/main.cjs | 13 ++++++-------
 dist/post.cjs |  8 ++------
 2 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/dist/main.cjs b/dist/main.cjs
index 0d6d1a44..51e544a7 100644
--- a/dist/main.cjs
+++ b/dist/main.cjs
@@ -3023,7 +3023,7 @@ var require_dist_node6 = __commonJS({
     module2.exports = __toCommonJS2(dist_src_exports);
     function oauthAuthorizationUrl(options) {
       const clientType = options.clientType || "oauth-app";
-      const baseUrl = options.baseUrl || "https://github.com";
+      const baseUrl2 = options.baseUrl || "https://github.com";
       const result = {
         clientType,
         allowSignup: options.allowSignup === false ? false : true,
@@ -3037,7 +3037,7 @@ var require_dist_node6 = __commonJS({
         const scopes = "scopes" in options ? options.scopes : [];
         result.scopes = typeof scopes === "string" ? scopes.split(/[,\s]+/).filter(Boolean) : scopes;
       }
-      result.url = urlBuilderAuthorize(`${baseUrl}/login/oauth/authorize`, result);
+      result.url = urlBuilderAuthorize(`${baseUrl2}/login/oauth/authorize`, result);
       return result;
     }
     function urlBuilderAuthorize(base, options) {
@@ -3149,10 +3149,10 @@ var require_dist_node7 = __commonJS({
       request: request2 = import_request3.request,
       ...options
     }) {
-      const baseUrl = requestToOAuthBaseUrl(request2);
+      const baseUrl2 = requestToOAuthBaseUrl(request2);
       return (0, import_oauth_authorization_url.oauthAuthorizationUrl)({
         ...options,
-        baseUrl
+        baseUrl: baseUrl2
       });
     }
     var import_request22 = require_dist_node5();
@@ -10483,6 +10483,7 @@ var repositories = import_core.default.getInput("repositories");
 var skipTokenRevoke = Boolean(
   import_core.default.getInput("skip-token-revoke") || import_core.default.getInput("skip_token_revoke")
 );
+var baseUrl = import_core.default.getInput("github-api-url").replace(/\/$/, "");
 main(
   appId,
   privateKey,
@@ -10490,9 +10491,7 @@ main(
   repositories,
   import_core.default,
   import_auth_app.createAppAuth,
-  request_default.defaults({
-    baseUrl: process.env["GITHUB_API_URL"]
-  }),
+  request_default.defaults({ baseUrl }),
   skipTokenRevoke
 ).catch((error) => {
   console.error(error);
diff --git a/dist/post.cjs b/dist/post.cjs
index 6e50d705..2022ab87 100644
--- a/dist/post.cjs
+++ b/dist/post.cjs
@@ -3021,12 +3021,8 @@ var request_default = import_request.request.defaults({
 });
 
 // post.js
-post(
-  import_core.default,
-  request_default.defaults({
-    baseUrl: process.env["GITHUB_API_URL"]
-  })
-).catch((error) => {
+var baseUrl = import_core.default.getInput("github-api-url").replace(/\/$/, "");
+post(import_core.default, request_default.defaults({ baseUrl })).catch((error) => {
   console.error(error);
   import_core.default.setFailed(error.message);
 });

From 1b900aab42a4f482ad8c6021734321166d2c3c08 Mon Sep 17 00:00:00 2001
From: Gregor Martynus <39992+gr2m@users.noreply.github.com>
Date: Thu, 25 Jan 2024 15:43:24 -0800
Subject: [PATCH 07/15] test: update snapshots

---
 tests/snapshots/index.js.md   |   4 ++--
 tests/snapshots/index.js.snap | Bin 1060 -> 1052 bytes
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/snapshots/index.js.md b/tests/snapshots/index.js.md
index 50a51129..09d08cd0 100644
--- a/tests/snapshots/index.js.md
+++ b/tests/snapshots/index.js.md
@@ -194,7 +194,7 @@ Generated by [AVA](https://avajs.dev).
 
 > stdout
 
-    '::warning::Token revocation failed: '
+    '::warning::Token revocation failed: Invalid URL'
 
 ## post-token-expired.test.js
 
@@ -214,7 +214,7 @@ Generated by [AVA](https://avajs.dev).
 
 > stdout
 
-    'Token revoked'
+    '::warning::Token revocation failed: Invalid URL'
 
 ## post-token-skipped.test.js
 
diff --git a/tests/snapshots/index.js.snap b/tests/snapshots/index.js.snap
index 47808b0eb787387e49ea9ca65bfd3e6451f456ba..ee22f99720773822c0d9724e295205866e3f4c7f 100644
GIT binary patch
literal 1052
zcmV+%1mpWbRzV<BZeeh9Xm4~Nb~6eC0Qb&qN;KmSg9qmXXzWfIg4fK4`N5`V@OrJz
zGXk%PVIPYK00000000B+n9pw;MHI(lDum<{y;XqV$rq>8n|PgIC!-dTR%v1hNM#a{
zA|W&OK0AYVXO@{+CzX0YT)80*h#S4|fAN=~omu}F;&sw&Dk0TAS?l%pefNF7GtZvC
z2E9=9N9wm%sF@D&0%%_|!My-uiG8Xu@EDI1tu{0&z44=Biqlw~39Wv46$Dh%ukNh9
zx0b$2@2=fl!;tnc94H;2l=g<_B|3l0JDn1Z<1P!}pPzq+s(oJtreIbRC=cMAg(371
zBt~M40Wb~}28m82!WgAuf^WcyLZjgs4X!lOV51yMHl`Z8BYa`2%v~r}DiiXo(4?Lk
zvAC<n2zgiHSd7qCy>z))?NrV)a^6%fb1-YWNc4o|hY@Ami<nZ34?WwYT#Tom%|j|x
z+bMOB_*24U=9CK!Dv9HeVL-s@E#RFOh&g8;IL^d5N11Qzz%jOa&^|sqdED*nKRf!S
zeSFk;-aY#E>-`R7YBh)wrPGEg)Sv}a9~%A7t2eU>j@3E*`G$#OxOQbH=R|Mj@e{|R
z#8@b%g<N9s(6LA^_4LYaZaz%Q+_b4%#;}d@5VcK!r%)U7-hi^ulc-|B6&Bfe{&qH=
zKT4*KAuw$cLzO;T4f+zPW_$?777T=RZ>prOFfa})kSYbxdjS=@VX8{`srfu@l99qW
zA@{rMRBMc44gP%s2TUI(J=lBJHmRUv%0k);u}laJ0xzO!M9A<=b^Yd(7H&75Hg+5R
z=C0q^Z?*h-e`jlFYrD0FerxCPHZ7M4NxLW#oo0^H2p<_2uOUH*qGR-wP9Nb$3JXl&
zMa(3sJxxfX?l--9%k%x?MuYg<#IJw1FeLu+kfd+4@FL3dbAFA8ymTTG6^lrgg-sg(
zZ^-mn(la}+`9^K>xfUWEF}*NGZ$0<=wYUpjXlDo=?BBmp>?_QRFgJ2Br*x&AV_w1)
z>LQ?z9ME5s9CBt3=OCtG=wePU4%rwv*s!cvPFXgWu}l=o+Z*YBIy`^9O`a+e{ZWX^
zC;8;2)fB&8H1dDyO``F?U+2?Yy!9|2EQD#;O^0(4h{A#RLpGH!)3euSpk8wvGY<Vk
zO5{3ITA%La_g9d;s~{I%tN%R@%K7oNY}M*BoHCsK;f3`|9`qI1i)t*C&W?^UzPB`%
zPaiqw37dqRQ^^@05^`*irA7NRU1DJW3KMAaF%4M&C!H@BpAi|i)~0>h{KKoO4K^Kv
z>(*5!TZ8muEuIBz=5~>@@tm<j3*k+7%{*11u6^nl{OFRabE+V#ve3=FIX4A&jnj`E
WFYj9~Y`RN0_5THzHQ^E0761VE`245<

literal 1060
zcmV+<1l#*TRzV<BZeeh9Xm4~Nb~6eC0Hq<9n)W7@hc>Qq_UN>STu^@jIt)OP3QH@o
z*UdRcP#=p300000000B+n9pz9HWbI>6~ll41=icJ4jT~+aJpKlrDS#@v_;b)O>)>$
zWGR*o7(Ci~c34ZIN>WY=^ib@&+pxp1TYKsM)xTu?A=~02*=dvk18QF^P}F;0z0X&C
z5?}YbA?*$MA8$Yq5yBb5Jwa&f1duT3VF7_d;v^M(O#l~b&p6>RPWTBG{I@qjfCc{k
z+R`UW>R0=C>BbU-xC>#QivSoi6Q0&^e#%FOHJl_J5}<dl{zP?iTt|eXX-<UW0G*OB
zL|s4(B07>|Bt{tZQ;{-2BVb(0TtiPd=opTU5pw}JSX)jQ8Ob=EA-phIas$;;Wq}+M
zXq=A^NzxH?2yutONdB9w=Z350R^c2S&Y6VE6imxbQ!!?FGr}ZxBEmU|2aYLHDaPY(
z^N?!weMMc0dY%%NDUGQ>JWZ02K;R=2uYh-%A#%z-x0KP-7+ATmT}#;3?*7r<lZTzd
zoyP}1?jIc-KJ6U*^ux{}%Az$;lyad8%0VDOQT?utf4_b?smPL=!(T4gw*)ulRx%g#
zavHy~G%`piCxWsW689{L{<)gYt>&G(D$Qk!x~>HqD-S>z2RJf?7Vq>i3FQ$_Xw0F?
z!t>Tzc>b#CJet6yNCddLw+8Alz(U?K(y~yWGJDdBQYDu|HMoLQqyTkapcS)V@|ERB
z`n)QV4h6YD_O+{62#6Aa+*>}{C1Nk_qV31~+7);tXX0)M%f63;z=<#)`u^aAcih%@
zZP@T0d0SquwdHy{?Y7(OZLV*wZ?w0;ZErr@z{~O~RYh59<+&I~a8Ijvj}S5f9)ZJ!
zx`j(cC=dZ>i8Mdo7QXK_-ImjAJFa`=dA_^hyUm{qP2$cri8>He7AP+F`2{TU(y~ZY
z%_5l>?id3&10qh+u3mZd6^-$EL1{Q7qR>VkJon~>xYM}O$`D%EfB8?bFEAHj_DV4;
zy3F)3CzTyQQ~`Zpfqqc4$mu>@f*8x!GHbFL9FUPbZOpP@IbqqF#WLmc_{v)P-xkl`
zuaYN^<fl*wvpe~C(xQuB%o^pddSh$+@1OIDFFtsfw+mrvc9Z5@1tPT|{+e~=^YqO4
z6x4gRWBG~QOBsV$WRX@UYx%7OWM>}a%FpV*_k&7azGgkO;shoPrysl$WEu1Y*t5DU
zlgPG?GQL;TmXAGaKjCZNKgBGT#C-oqBU4FxSUqCMd<y%hcw<OQG}_E9mhV{2SJkpq
ztr{s=*alMDY01=8Q;9{&Mmb@X+<$!25_NrApCJTuYoaw*s>wH2`Y+DmImH}hSqjyB
emQz!4Avpfh((<X%LM9KsmH!_)WOQb#761SjZTVLK


From a441193146ae4ec609f3b4d839ff584d27021974 Mon Sep 17 00:00:00 2001
From: Gregor Martynus <39992+gr2m@users.noreply.github.com>
Date: Thu, 25 Jan 2024 15:48:11 -0800
Subject: [PATCH 08/15] test: revert unrelated changes

---
 tests/main-token-get-owner-set-to-user-fail-response.test.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/main-token-get-owner-set-to-user-fail-response.test.js b/tests/main-token-get-owner-set-to-user-fail-response.test.js
index 8375bcee..e9fba9be 100644
--- a/tests/main-token-get-owner-set-to-user-fail-response.test.js
+++ b/tests/main-token-get-owner-set-to-user-fail-response.test.js
@@ -2,8 +2,8 @@ import { test } from "./main.js";
 
 // Verify `main` successfully obtains a token when the `owner` input is set (to a user), but the `repositories` input isn’t set.
 await test((mockPool) => {
-  process.env.INPUT_REPOSITORIES = "smockle";
   process.env.INPUT_OWNER = "smockle";
+  delete process.env.INPUT_REPOSITORIES;
 
   // Mock installation id request
   const mockInstallationId = "123456";

From 75fa8292819e8e598714f1b1538fc10ec9585e35 Mon Sep 17 00:00:00 2001
From: Gregor Martynus <39992+gr2m@users.noreply.github.com>
Date: Thu, 25 Jan 2024 16:13:46 -0800
Subject: [PATCH 09/15] test: `main-custom-github-api-url.test.js`

---
 tests/main-custom-github-api-url.test.js |  13 ++++++++
 tests/main.js                            |  36 +++++++++++++----------
 tests/snapshots/index.js.md              |  16 ++++++++++
 tests/snapshots/index.js.snap            | Bin 1052 -> 1072 bytes
 4 files changed, 49 insertions(+), 16 deletions(-)
 create mode 100644 tests/main-custom-github-api-url.test.js

diff --git a/tests/main-custom-github-api-url.test.js b/tests/main-custom-github-api-url.test.js
new file mode 100644
index 00000000..eb2cffa0
--- /dev/null
+++ b/tests/main-custom-github-api-url.test.js
@@ -0,0 +1,13 @@
+import { test, DEFAULT_ENV } from "./main.js";
+
+// Verify that main works with a custom GitHub API URL passed as `github-api-url` input
+await test(
+  () => {
+    process.env.INPUT_OWNER = process.env.GITHUB_REPOSITORY_OWNER;
+    process.env.INPUT_REPOSITORIES = process.env.GITHUB_REPOSITORY;
+  },
+  {
+    ...DEFAULT_ENV,
+    "INPUT_GITHUB-API-URL": "https://github.acme-inc.com/api/v3",
+  }
+);
diff --git a/tests/main.js b/tests/main.js
index 424a05c3..c9af8880 100644
--- a/tests/main.js
+++ b/tests/main.js
@@ -2,16 +2,15 @@
 // @ts-check
 import { MockAgent, setGlobalDispatcher } from "undici";
 
-export async function test(cb = (_mockPool) => {}) {
-  // Set required environment variables and inputs
-  process.env.GITHUB_REPOSITORY_OWNER = "actions";
-  process.env.GITHUB_REPOSITORY = "actions/create-github-app-token";
-
+export const DEFAULT_ENV = {
+  GITHUB_REPOSITORY_OWNER: "actions",
+  GITHUB_REPOSITORY: "actions/create-github-app-token",
   // inputs are set as environment variables with the prefix INPUT_
   // https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#example-specifying-inputs
-  process.env["INPUT_GITHUB-API-URL"] = "https://api.github.com";
-  process.env["INPUT_APP-ID"] = "123456";
-  process.env["INPUT_PRIVATE-KEY"] = `-----BEGIN RSA PRIVATE KEY-----
+  "INPUT_GITHUB-API-URL": "https://api.github.com",
+  "INPUT_APP-ID": "123456",
+  // This key is invalidated. It’s from https://github.com/octokit/auth-app.js/issues/465#issuecomment-1564998327.
+  "INPUT_PRIVATE-KEY": `-----BEGIN RSA PRIVATE KEY-----
 MIIEowIBAAKCAQEA280nfuUM9w00Ib9E2rvZJ6Qu3Ua3IqR34ZlK53vn/Iobn2EL
 Z9puc5Q/nFBU15NKwHyQNb+OG2hTCkjd1Xi9XPzEOH1r42YQmTGq8YCkUSkk6KZA
 5dnhLwN9pFquT9fQgrf4r1D5GJj3rqvj8JDr1sBmunArqY5u4gziSrIohcjLIZV0
@@ -37,27 +36,32 @@ r4J2gqb0xTDfq7gLMNrIXc2QQM4gKbnJp60JQM3p9NmH8huavBZGvSvNzTwXyGG3
 so0tiQKBgGQXZaxaXhYUcxYHuCkQ3V4Vsj3ezlM92xXlP32SGFm3KgFhYy9kATxw
 Cax1ytZzvlrKLQyQFVK1COs2rHt7W4cJ7op7C8zXfsigXCiejnS664oAuX8sQZID
 x3WQZRiXlWejSMUAHuMwXrhGlltF3lw83+xAjnqsVp75kGS6OH61
------END RSA PRIVATE KEY-----`; // This key is invalidated. It’s from https://github.com/octokit/auth-app.js/issues/465#issuecomment-1564998327.
+-----END RSA PRIVATE KEY-----`,
+};
+
+export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
+  for (const [key, value] of Object.entries(env)) {
+    process.env[key] = value;
+  }
 
   // Set up mocking
+  const baseUrl = new URL(env["INPUT_GITHUB-API-URL"]);
   const mockAgent = new MockAgent();
   mockAgent.disableNetConnect();
   setGlobalDispatcher(mockAgent);
-  const mockPool = mockAgent.get("https://api.github.com");
+  const mockPool = mockAgent.get(baseUrl.origin);
 
   // Calling `auth({ type: "app" })` to obtain a JWT doesn’t make network requests, so no need to intercept.
 
   // Mock installation id request
   const mockInstallationId = "123456";
-  const owner = process.env.INPUT_OWNER ?? process.env.GITHUB_REPOSITORY_OWNER;
+  const owner = env.INPUT_OWNER ?? env.GITHUB_REPOSITORY_OWNER;
   const repo = encodeURIComponent(
-    (process.env.INPUT_REPOSITORIES ?? process.env.GITHUB_REPOSITORY).split(
-      ","
-    )[0]
+    (env.INPUT_REPOSITORIES ?? env.GITHUB_REPOSITORY).split(",")[0]
   );
   mockPool
     .intercept({
-      path: `/repos/${owner}/${repo}/installation`,
+      path: `${baseUrl.pathname}/repos/${owner}/${repo}/installation`,
       method: "GET",
       headers: {
         accept: "application/vnd.github.v3+json",
@@ -77,7 +81,7 @@ x3WQZRiXlWejSMUAHuMwXrhGlltF3lw83+xAjnqsVp75kGS6OH61
   const mockExpiresAt = "2016-07-11T22:14:10Z";
   mockPool
     .intercept({
-      path: `/app/installations/${mockInstallationId}/access_tokens`,
+      path: `${baseUrl.pathname}/app/installations/${mockInstallationId}/access_tokens`,
       method: "POST",
       headers: {
         accept: "application/vnd.github.v3+json",
diff --git a/tests/snapshots/index.js.md b/tests/snapshots/index.js.md
index 09d08cd0..21b07dca 100644
--- a/tests/snapshots/index.js.md
+++ b/tests/snapshots/index.js.md
@@ -16,6 +16,22 @@ Generated by [AVA](https://avajs.dev).
     private_key — 'private_key' is deprecated and will be removed in a future version. Use 'private-key' instead.␊
     skip_token_revoke — 'skip_token_revoke' is deprecated and will be removed in a future version. Use 'skip-token-revoke' instead.`
 
+## main-custom-github-api-url.test.js
+
+> stderr
+
+    ''
+
+> stdout
+
+    `owner and repositories set, creating token for repositories "actions/create-github-app-token" owned by "actions"␊
+    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
+    ␊
+    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
+    ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
+    ␊
+    ::set-output name=expiresAt::2016-07-11T22:14:10Z`
+
 ## main-missing-app-id.test.js
 
 > stderr
diff --git a/tests/snapshots/index.js.snap b/tests/snapshots/index.js.snap
index ee22f99720773822c0d9724e295205866e3f4c7f..76994a1dab108876f7b3eb5cdbba326a37037da7 100644
GIT binary patch
literal 1072
zcmV-01kd|HRzV<BZeeh9Xm4~Nb~6eC0N6vyTLnMHO<wUkIq*$3T+zMhpdWDO?lyz#
zNtu;GJs*n*00000000B+n9pzHL=?vxRtTvl_J#n#Q!nX4r;XE+w4+@_7j@f6Kv$s^
zT_hAH_G>!Co-s4eX;<QaxN?L8;>KS1zxYd#e>BO^IPKP5fkbkOoXPinJ)if(o<C0e
zq4tONmlsHqLc9Rslhld@7#s8jVZfw{6SC`sme#+s(kc<#GfnoV7eOFMe131~jivNc
zdwuEt5{9CW;i;tnjmZ~0tBL6)uXSr8j(akIzkd7`>iPFNNDGsgAXEV7G7O=QU@+1n
z3_vOnaGFqJ5JqUM)M_1$EoK@l(@>UB1nbMOkt0Fa8{+dk%G8Bwp$Z|E3th&uLmBr-
z4^j0Dj`R@os8=pmi=E1`OpcA^3I~&I*9l#+T#1BK%ug)ohz%s2C4DAh$r2M*p&2?f
zzp3eSg(kZdgR!=fw2^4RBCUaMP>@su$ZW%@HtwR8Jl*U@wh$*SiyK{mR6T(H^YPM^
zWzIzqut?Y;=Yuob^ID&_ajW^HxzqGpJ6?0I-S!&(_U88HR(lt{_V(i~vAoQ=MPfRk
zI3Z9X!be$zmyqDxiV-qPg79_<Gfdz`EDhRS;=I}LTCCA#o_Ex2a&L=!jjv~deJ2AO
zNo%DVusr)qiJp8k&8t@Lq~#0-zfYtoQc!6Eo5XP_G2oEv%|Kt48&l5ScARCIQEqJC
zF}AbcIXXCg-0SW=J^ZqBbl82?JN)X4y)G1LYY-)t(n_&NKpN@~GyRY2x3db4)v3BJ
zH_RQwYuE1Nl<4g|zVCP(SI!)Z2aZL4Wlyi&&5eg?nA>jZW@b3=QG+zoQ%#oUe5%S$
zg$$WN8*62;N)P(e=|R6$>p`h23^Io^`^}T=_jHr;E;S|O{&!UnVH6X14>;^gI!OAk
z`?Ql~g%}ALihhWT_T|k_lJpB{7710J=Ql`^ADk44Ug?-xyZoKB4u_H!V`~=o#*MgZ
zRjD&9o=*O4%*|5FDP5D#F_tKcR0Z^*1NxJiLoS=cC5S~Bx|q|8135wkd9o~6j#;+m
zu}mzQyBq1hJ3N2BOP)5;{xHP(ll*egVv64^HOe3LE>q(_U+3ez_}|0)a3;)*-FP@x
zfv6pb-xgE(D!u&r1k_88W2wMTj6p?(((1UEKUhF!*FmmatN%RcD|z^uSG9D8V}_F#
zURYfzgT4TJQIEBy;!LpMdq-pW<dJipu)+DcFiNTc=SLZ`G^j7q5`+9zm_tX6L?{C|
z?tV7=j3{%P+syB_{P5~}gDuD4YVN9#U4!(<G@c~b#O*9+qbXyR3gK1nT6R~JcI^Yl
q;Ja5`oeK*^l$mbcnsQUIYn;62czHATBFA0AiT^j9x0d*@7ytlUtrxuj

literal 1052
zcmV+%1mpWbRzV<BZeeh9Xm4~Nb~6eC0Qb&qN;KmSg9qmXXzWfIg4fK4`N5`V@OrJz
zGXk%PVIPYK00000000B+n9pw;MHI(lDum<{y;XqV$rq>8n|PgIC!-dTR%v1hNM#a{
zA|W&OK0AYVXO@{+CzX0YT)80*h#S4|fAN=~omu}F;&sw&Dk0TAS?l%pefNF7GtZvC
z2E9=9N9wm%sF@D&0%%_|!My-uiG8Xu@EDI1tu{0&z44=Biqlw~39Wv46$Dh%ukNh9
zx0b$2@2=fl!;tnc94H;2l=g<_B|3l0JDn1Z<1P!}pPzq+s(oJtreIbRC=cMAg(371
zBt~M40Wb~}28m82!WgAuf^WcyLZjgs4X!lOV51yMHl`Z8BYa`2%v~r}DiiXo(4?Lk
zvAC<n2zgiHSd7qCy>z))?NrV)a^6%fb1-YWNc4o|hY@Ami<nZ34?WwYT#Tom%|j|x
z+bMOB_*24U=9CK!Dv9HeVL-s@E#RFOh&g8;IL^d5N11Qzz%jOa&^|sqdED*nKRf!S
zeSFk;-aY#E>-`R7YBh)wrPGEg)Sv}a9~%A7t2eU>j@3E*`G$#OxOQbH=R|Mj@e{|R
z#8@b%g<N9s(6LA^_4LYaZaz%Q+_b4%#;}d@5VcK!r%)U7-hi^ulc-|B6&Bfe{&qH=
zKT4*KAuw$cLzO;T4f+zPW_$?777T=RZ>prOFfa})kSYbxdjS=@VX8{`srfu@l99qW
zA@{rMRBMc44gP%s2TUI(J=lBJHmRUv%0k);u}laJ0xzO!M9A<=b^Yd(7H&75Hg+5R
z=C0q^Z?*h-e`jlFYrD0FerxCPHZ7M4NxLW#oo0^H2p<_2uOUH*qGR-wP9Nb$3JXl&
zMa(3sJxxfX?l--9%k%x?MuYg<#IJw1FeLu+kfd+4@FL3dbAFA8ymTTG6^lrgg-sg(
zZ^-mn(la}+`9^K>xfUWEF}*NGZ$0<=wYUpjXlDo=?BBmp>?_QRFgJ2Br*x&AV_w1)
z>LQ?z9ME5s9CBt3=OCtG=wePU4%rwv*s!cvPFXgWu}l=o+Z*YBIy`^9O`a+e{ZWX^
zC;8;2)fB&8H1dDyO``F?U+2?Yy!9|2EQD#;O^0(4h{A#RLpGH!)3euSpk8wvGY<Vk
zO5{3ITA%La_g9d;s~{I%tN%R@%K7oNY}M*BoHCsK;f3`|9`qI1i)t*C&W?^UzPB`%
zPaiqw37dqRQ^^@05^`*irA7NRU1DJW3KMAaF%4M&C!H@BpAi|i)~0>h{KKoO4K^Kv
z>(*5!TZ8muEuIBz=5~>@@tm<j3*k+7%{*11u6^nl{OFRabE+V#ve3=FIX4A&jnj`E
WFYj9~Y`RN0_5THzHQ^E0761VE`245<


From 90af6c20f414df223db20d817c8098e8ae072196 Mon Sep 17 00:00:00 2001
From: Gregor Martynus <39992+gr2m@users.noreply.github.com>
Date: Thu, 25 Jan 2024 16:19:33 -0800
Subject: [PATCH 10/15] yeah it is ugly but we have to clean up our tests
 anyway

---
 ...token-get-owner-set-repo-fail-response.test.js | 15 +++++++--------
 tests/main.js                                     | 10 ++++++++--
 2 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/tests/main-token-get-owner-set-repo-fail-response.test.js b/tests/main-token-get-owner-set-repo-fail-response.test.js
index 97293767..14c5811e 100644
--- a/tests/main-token-get-owner-set-repo-fail-response.test.js
+++ b/tests/main-token-get-owner-set-repo-fail-response.test.js
@@ -2,10 +2,10 @@ import { test } from "./main.js";
 
 // Verify `main` retry when  the GitHub API returns a 500 error.
 await test((mockPool) => {
-  process.env.INPUT_OWNER = 'actions'
-  process.env.INPUT_REPOSITORIES = 'failed-repo';
-  const owner = process.env.INPUT_OWNER
-  const repo = process.env.INPUT_REPOSITORIES
+  process.env.INPUT_OWNER = "actions";
+  process.env.INPUT_REPOSITORIES = "failed-repo";
+  const owner = process.env.INPUT_OWNER;
+  const repo = process.env.INPUT_REPOSITORIES;
   const mockInstallationId = "123456";
 
   mockPool
@@ -18,9 +18,9 @@ await test((mockPool) => {
         // Intentionally omitting the `authorization` header, since JWT creation is not idempotent.
       },
     })
-    .reply(500, 'GitHub API not available')
-    
-    mockPool
+    .reply(500, "GitHub API not available");
+
+  mockPool
     .intercept({
       path: `/repos/${owner}/${repo}/installation`,
       method: "GET",
@@ -35,5 +35,4 @@ await test((mockPool) => {
       { id: mockInstallationId },
       { headers: { "content-type": "application/json" } }
     );
-
 });
diff --git a/tests/main.js b/tests/main.js
index c9af8880..1648690b 100644
--- a/tests/main.js
+++ b/tests/main.js
@@ -61,7 +61,10 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
   );
   mockPool
     .intercept({
-      path: `${baseUrl.pathname}/repos/${owner}/${repo}/installation`,
+      path: `${baseUrl.pathname}/repos/${owner}/${repo}/installation`.replace(
+        "//",
+        "/"
+      ),
       method: "GET",
       headers: {
         accept: "application/vnd.github.v3+json",
@@ -81,7 +84,10 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
   const mockExpiresAt = "2016-07-11T22:14:10Z";
   mockPool
     .intercept({
-      path: `${baseUrl.pathname}/app/installations/${mockInstallationId}/access_tokens`,
+      path: `${baseUrl.pathname}/app/installations/${mockInstallationId}/access_tokens`.replace(
+        "//",
+        "/"
+      ),
       method: "POST",
       headers: {
         accept: "application/vnd.github.v3+json",

From 998bbe7d68d434afcf5a698ed49954b3f66c67ab Mon Sep 17 00:00:00 2001
From: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
Date: Thu, 25 Jan 2024 18:48:21 -0800
Subject: [PATCH 11/15] Remove default `baseUrl` from lib/request.js

---
 lib/request.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/request.js b/lib/request.js
index 729cc194..43a6fcc0 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -1,7 +1,6 @@
 import { request } from "@octokit/request";
 
 export default request.defaults({
-  baseUrl: process.env["GITHUB_API_URL"],
   headers: {
     "user-agent": "actions/create-github-app-token",
   },

From a659499ccba1ef8ca2313839973cd05036e8e198 Mon Sep 17 00:00:00 2001
From: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
Date: Thu, 25 Jan 2024 18:49:23 -0800
Subject: [PATCH 12/15] Add missing environment variable

---
 tests/post-revoke-token-fail-response.test.js | 8 +++++++-
 tests/post-token-set.test.js                  | 4 ++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/tests/post-revoke-token-fail-response.test.js b/tests/post-revoke-token-fail-response.test.js
index 5ce31eca..6962ca3e 100644
--- a/tests/post-revoke-token-fail-response.test.js
+++ b/tests/post-revoke-token-fail-response.test.js
@@ -4,8 +4,14 @@ import { MockAgent, setGlobalDispatcher } from "undici";
 // https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#sending-values-to-the-pre-and-post-actions
 process.env.STATE_token = "secret123";
 
+// inputs are set as environment variables with the prefix INPUT_
+// https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#example-specifying-inputs
+process.env["INPUT_GITHUB-API-URL"] = "https://api.github.com";
+
 // 1 hour in the future, not expired
-process.env.STATE_expiresAt = new Date(Date.now() + 1000 * 60 * 60).toISOString();
+process.env.STATE_expiresAt = new Date(
+  Date.now() + 1000 * 60 * 60
+).toISOString();
 
 const mockAgent = new MockAgent();
 
diff --git a/tests/post-token-set.test.js b/tests/post-token-set.test.js
index 5b2479ea..33697d0c 100644
--- a/tests/post-token-set.test.js
+++ b/tests/post-token-set.test.js
@@ -4,6 +4,10 @@ import { MockAgent, setGlobalDispatcher } from "undici";
 // https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#sending-values-to-the-pre-and-post-actions
 process.env.STATE_token = "secret123";
 
+// inputs are set as environment variables with the prefix INPUT_
+// https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#example-specifying-inputs
+process.env["INPUT_GITHUB-API-URL"] = "https://api.github.com";
+
 // 1 hour in the future, not expired
 process.env.STATE_expiresAt = new Date(Date.now() + 1000 * 60 * 60).toISOString();
 

From c1f802e16342115b39a80dbd0156e69da0a34662 Mon Sep 17 00:00:00 2001
From: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
Date: Thu, 25 Jan 2024 18:50:32 -0800
Subject: [PATCH 13/15] Fix URL handling and update snapshots

---
 tests/main.js                 |  17 +++++++----------
 tests/snapshots/index.js.md   |  20 ++------------------
 tests/snapshots/index.js.snap | Bin 1072 -> 1060 bytes
 3 files changed, 9 insertions(+), 28 deletions(-)

diff --git a/tests/main.js b/tests/main.js
index 1648690b..bf6c491e 100644
--- a/tests/main.js
+++ b/tests/main.js
@@ -45,11 +45,12 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
   }
 
   // Set up mocking
-  const baseUrl = new URL(env["INPUT_GITHUB-API-URL"]);
+  const baseUrl = env["INPUT_GITHUB-API-URL"];
+  const url = new URL(baseUrl);
   const mockAgent = new MockAgent();
   mockAgent.disableNetConnect();
   setGlobalDispatcher(mockAgent);
-  const mockPool = mockAgent.get(baseUrl.origin);
+  const mockPool = mockAgent.get(baseUrl);
 
   // Calling `auth({ type: "app" })` to obtain a JWT doesn’t make network requests, so no need to intercept.
 
@@ -59,12 +60,10 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
   const repo = encodeURIComponent(
     (env.INPUT_REPOSITORIES ?? env.GITHUB_REPOSITORY).split(",")[0]
   );
+  url.pathname = `/repos/${owner}/${repo}/installation`;
   mockPool
     .intercept({
-      path: `${baseUrl.pathname}/repos/${owner}/${repo}/installation`.replace(
-        "//",
-        "/"
-      ),
+      path: `${url.toString()}`,
       method: "GET",
       headers: {
         accept: "application/vnd.github.v3+json",
@@ -82,12 +81,10 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
   const mockInstallationAccessToken =
     "ghs_16C7e42F292c6912E7710c838347Ae178B4a"; // This token is invalidated. It’s from https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#create-an-installation-access-token-for-an-app.
   const mockExpiresAt = "2016-07-11T22:14:10Z";
+  url.pathname = `/app/installations/${mockInstallationId}/access_tokens`
   mockPool
     .intercept({
-      path: `${baseUrl.pathname}/app/installations/${mockInstallationId}/access_tokens`.replace(
-        "//",
-        "/"
-      ),
+      path: `${url.toString()}`,
       method: "POST",
       headers: {
         accept: "application/vnd.github.v3+json",
diff --git a/tests/snapshots/index.js.md b/tests/snapshots/index.js.md
index 21b07dca..50a51129 100644
--- a/tests/snapshots/index.js.md
+++ b/tests/snapshots/index.js.md
@@ -16,22 +16,6 @@ Generated by [AVA](https://avajs.dev).
     private_key — 'private_key' is deprecated and will be removed in a future version. Use 'private-key' instead.␊
     skip_token_revoke — 'skip_token_revoke' is deprecated and will be removed in a future version. Use 'skip-token-revoke' instead.`
 
-## main-custom-github-api-url.test.js
-
-> stderr
-
-    ''
-
-> stdout
-
-    `owner and repositories set, creating token for repositories "actions/create-github-app-token" owned by "actions"␊
-    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
-    ␊
-    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
-    ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
-    ␊
-    ::set-output name=expiresAt::2016-07-11T22:14:10Z`
-
 ## main-missing-app-id.test.js
 
 > stderr
@@ -210,7 +194,7 @@ Generated by [AVA](https://avajs.dev).
 
 > stdout
 
-    '::warning::Token revocation failed: Invalid URL'
+    '::warning::Token revocation failed: '
 
 ## post-token-expired.test.js
 
@@ -230,7 +214,7 @@ Generated by [AVA](https://avajs.dev).
 
 > stdout
 
-    '::warning::Token revocation failed: Invalid URL'
+    'Token revoked'
 
 ## post-token-skipped.test.js
 
diff --git a/tests/snapshots/index.js.snap b/tests/snapshots/index.js.snap
index 76994a1dab108876f7b3eb5cdbba326a37037da7..47808b0eb787387e49ea9ca65bfd3e6451f456ba 100644
GIT binary patch
literal 1060
zcmV+<1l#*TRzV<BZeeh9Xm4~Nb~6eC0Hq<9n)W7@hc>Qq_UN>STu^@jIt)OP3QH@o
z*UdRcP#=p300000000B+n9pz9HWbI>6~ll41=icJ4jT~+aJpKlrDS#@v_;b)O>)>$
zWGR*o7(Ci~c34ZIN>WY=^ib@&+pxp1TYKsM)xTu?A=~02*=dvk18QF^P}F;0z0X&C
z5?}YbA?*$MA8$Yq5yBb5Jwa&f1duT3VF7_d;v^M(O#l~b&p6>RPWTBG{I@qjfCc{k
z+R`UW>R0=C>BbU-xC>#QivSoi6Q0&^e#%FOHJl_J5}<dl{zP?iTt|eXX-<UW0G*OB
zL|s4(B07>|Bt{tZQ;{-2BVb(0TtiPd=opTU5pw}JSX)jQ8Ob=EA-phIas$;;Wq}+M
zXq=A^NzxH?2yutONdB9w=Z350R^c2S&Y6VE6imxbQ!!?FGr}ZxBEmU|2aYLHDaPY(
z^N?!weMMc0dY%%NDUGQ>JWZ02K;R=2uYh-%A#%z-x0KP-7+ATmT}#;3?*7r<lZTzd
zoyP}1?jIc-KJ6U*^ux{}%Az$;lyad8%0VDOQT?utf4_b?smPL=!(T4gw*)ulRx%g#
zavHy~G%`piCxWsW689{L{<)gYt>&G(D$Qk!x~>HqD-S>z2RJf?7Vq>i3FQ$_Xw0F?
z!t>Tzc>b#CJet6yNCddLw+8Alz(U?K(y~yWGJDdBQYDu|HMoLQqyTkapcS)V@|ERB
z`n)QV4h6YD_O+{62#6Aa+*>}{C1Nk_qV31~+7);tXX0)M%f63;z=<#)`u^aAcih%@
zZP@T0d0SquwdHy{?Y7(OZLV*wZ?w0;ZErr@z{~O~RYh59<+&I~a8Ijvj}S5f9)ZJ!
zx`j(cC=dZ>i8Mdo7QXK_-ImjAJFa`=dA_^hyUm{qP2$cri8>He7AP+F`2{TU(y~ZY
z%_5l>?id3&10qh+u3mZd6^-$EL1{Q7qR>VkJon~>xYM}O$`D%EfB8?bFEAHj_DV4;
zy3F)3CzTyQQ~`Zpfqqc4$mu>@f*8x!GHbFL9FUPbZOpP@IbqqF#WLmc_{v)P-xkl`
zuaYN^<fl*wvpe~C(xQuB%o^pddSh$+@1OIDFFtsfw+mrvc9Z5@1tPT|{+e~=^YqO4
z6x4gRWBG~QOBsV$WRX@UYx%7OWM>}a%FpV*_k&7azGgkO;shoPrysl$WEu1Y*t5DU
zlgPG?GQL;TmXAGaKjCZNKgBGT#C-oqBU4FxSUqCMd<y%hcw<OQG}_E9mhV{2SJkpq
ztr{s=*alMDY01=8Q;9{&Mmb@X+<$!25_NrApCJTuYoaw*s>wH2`Y+DmImH}hSqjyB
emQz!4Avpfh((<X%LM9KsmH!_)WOQb#761SjZTVLK

literal 1072
zcmV-01kd|HRzV<BZeeh9Xm4~Nb~6eC0N6vyTLnMHO<wUkIq*$3T+zMhpdWDO?lyz#
zNtu;GJs*n*00000000B+n9pzHL=?vxRtTvl_J#n#Q!nX4r;XE+w4+@_7j@f6Kv$s^
zT_hAH_G>!Co-s4eX;<QaxN?L8;>KS1zxYd#e>BO^IPKP5fkbkOoXPinJ)if(o<C0e
zq4tONmlsHqLc9Rslhld@7#s8jVZfw{6SC`sme#+s(kc<#GfnoV7eOFMe131~jivNc
zdwuEt5{9CW;i;tnjmZ~0tBL6)uXSr8j(akIzkd7`>iPFNNDGsgAXEV7G7O=QU@+1n
z3_vOnaGFqJ5JqUM)M_1$EoK@l(@>UB1nbMOkt0Fa8{+dk%G8Bwp$Z|E3th&uLmBr-
z4^j0Dj`R@os8=pmi=E1`OpcA^3I~&I*9l#+T#1BK%ug)ohz%s2C4DAh$r2M*p&2?f
zzp3eSg(kZdgR!=fw2^4RBCUaMP>@su$ZW%@HtwR8Jl*U@wh$*SiyK{mR6T(H^YPM^
zWzIzqut?Y;=Yuob^ID&_ajW^HxzqGpJ6?0I-S!&(_U88HR(lt{_V(i~vAoQ=MPfRk
zI3Z9X!be$zmyqDxiV-qPg79_<Gfdz`EDhRS;=I}LTCCA#o_Ex2a&L=!jjv~deJ2AO
zNo%DVusr)qiJp8k&8t@Lq~#0-zfYtoQc!6Eo5XP_G2oEv%|Kt48&l5ScARCIQEqJC
zF}AbcIXXCg-0SW=J^ZqBbl82?JN)X4y)G1LYY-)t(n_&NKpN@~GyRY2x3db4)v3BJ
zH_RQwYuE1Nl<4g|zVCP(SI!)Z2aZL4Wlyi&&5eg?nA>jZW@b3=QG+zoQ%#oUe5%S$
zg$$WN8*62;N)P(e=|R6$>p`h23^Io^`^}T=_jHr;E;S|O{&!UnVH6X14>;^gI!OAk
z`?Ql~g%}ALihhWT_T|k_lJpB{7710J=Ql`^ADk44Ug?-xyZoKB4u_H!V`~=o#*MgZ
zRjD&9o=*O4%*|5FDP5D#F_tKcR0Z^*1NxJiLoS=cC5S~Bx|q|8135wkd9o~6j#;+m
zu}mzQyBq1hJ3N2BOP)5;{xHP(ll*egVv64^HOe3LE>q(_U+3ez_}|0)a3;)*-FP@x
zfv6pb-xgE(D!u&r1k_88W2wMTj6p?(((1UEKUhF!*FmmatN%RcD|z^uSG9D8V}_F#
zURYfzgT4TJQIEBy;!LpMdq-pW<dJipu)+DcFiNTc=SLZ`G^j7q5`+9zm_tX6L?{C|
z?tV7=j3{%P+syB_{P5~}gDuD4YVN9#U4!(<G@c~b#O*9+qbXyR3gK1nT6R~JcI^Yl
q;Ja5`oeK*^l$mbcnsQUIYn;62czHATBFA0AiT^j9x0d*@7ytlUtrxuj


From 7cda2d6dbd8f9821df586f8a863bb9c16b301ea1 Mon Sep 17 00:00:00 2001
From: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
Date: Fri, 26 Jan 2024 10:28:37 -0800
Subject: [PATCH 14/15] Fix tests and update snapshots

---
 tests/main.js                 |  12 +++++-------
 tests/snapshots/index.js.md   |  16 ++++++++++++++++
 tests/snapshots/index.js.snap | Bin 1060 -> 1081 bytes
 3 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/tests/main.js b/tests/main.js
index bf6c491e..a4ba940a 100644
--- a/tests/main.js
+++ b/tests/main.js
@@ -45,12 +45,12 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
   }
 
   // Set up mocking
-  const baseUrl = env["INPUT_GITHUB-API-URL"];
-  const url = new URL(baseUrl);
+  const baseUrl = new URL(env["INPUT_GITHUB-API-URL"]);
+  const basePath = baseUrl.pathname === '/' ? '' : baseUrl.pathname;
   const mockAgent = new MockAgent();
   mockAgent.disableNetConnect();
   setGlobalDispatcher(mockAgent);
-  const mockPool = mockAgent.get(baseUrl);
+  const mockPool = mockAgent.get(baseUrl.origin);
 
   // Calling `auth({ type: "app" })` to obtain a JWT doesn’t make network requests, so no need to intercept.
 
@@ -60,10 +60,9 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
   const repo = encodeURIComponent(
     (env.INPUT_REPOSITORIES ?? env.GITHUB_REPOSITORY).split(",")[0]
   );
-  url.pathname = `/repos/${owner}/${repo}/installation`;
   mockPool
     .intercept({
-      path: `${url.toString()}`,
+      path: `${basePath}/repos/${owner}/${repo}/installation`,
       method: "GET",
       headers: {
         accept: "application/vnd.github.v3+json",
@@ -81,10 +80,9 @@ export async function test(cb = (_mockPool) => {}, env = DEFAULT_ENV) {
   const mockInstallationAccessToken =
     "ghs_16C7e42F292c6912E7710c838347Ae178B4a"; // This token is invalidated. It’s from https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#create-an-installation-access-token-for-an-app.
   const mockExpiresAt = "2016-07-11T22:14:10Z";
-  url.pathname = `/app/installations/${mockInstallationId}/access_tokens`
   mockPool
     .intercept({
-      path: `${url.toString()}`,
+      path: `${basePath}/app/installations/${mockInstallationId}/access_tokens`,
       method: "POST",
       headers: {
         accept: "application/vnd.github.v3+json",
diff --git a/tests/snapshots/index.js.md b/tests/snapshots/index.js.md
index 50a51129..b42248ae 100644
--- a/tests/snapshots/index.js.md
+++ b/tests/snapshots/index.js.md
@@ -16,6 +16,22 @@ Generated by [AVA](https://avajs.dev).
     private_key — 'private_key' is deprecated and will be removed in a future version. Use 'private-key' instead.␊
     skip_token_revoke — 'skip_token_revoke' is deprecated and will be removed in a future version. Use 'skip-token-revoke' instead.`
 
+## main-custom-github-api-url.test.js
+
+> stderr
+
+    ''
+
+> stdout
+
+    `owner and repositories set, creating token for repositories "actions/create-github-app-token" owned by "actions"␊
+    ::add-mask::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
+    ␊
+    ::set-output name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
+    ::save-state name=token::ghs_16C7e42F292c6912E7710c838347Ae178B4a␊
+    ␊
+    ::set-output name=expiresAt::2016-07-11T22:14:10Z`
+
 ## main-missing-app-id.test.js
 
 > stderr
diff --git a/tests/snapshots/index.js.snap b/tests/snapshots/index.js.snap
index 47808b0eb787387e49ea9ca65bfd3e6451f456ba..46c364e9f519d9da66f3532f78903a7714b686ca 100644
GIT binary patch
literal 1081
zcmV-91jhS8RzV<BZeeh9Xm4~Nb~6eC0Gy3qc14FGCD`Q~s#T4#N}8))oChO52x)5^
zYLXiJ+#ibw00000000B+SkG@8MHG%f2q_X0y&;NV6jgExp47VucCspn6s1WHkSe4i
zt%S^Y_t}|xe=#%bq*4!vD@QmWZuG+c#b3hwSg$=~*G{uRMZ&pcH9P*^x9|Jjd%N?;
zpdTjwi2w2u1Qj7%AmR&}#5jPIflmYkn8s-)_=W&3HlA_HW0LZ-MDU+p1_2S|t2bBP
zUQvIIw^nYgKuG!!4!8(_F|*-GgUoJu<G4Z6v_}K<*N?xVrnzn+%F#3?B5{DuX&9nD
zAO=w~mTNRd1PwBgF+gKrT+-Y?k2z=ztTAFPfCL+>DWhYF(;LBa6J=(hUZ@-h8=y%%
zKB8$)BqNA>494=miF#?dUTg)2H5@MBat711Cz+UNxfT%`V?W~}iSUq$v#gIvN^!=*
zI%<ZNn%^~&^B9<Z6b5O+sYn<FjyQ-G@);08;~~<t(I8>=rZr<Xeot?NDa-sp*N{RF
zQ2%+cb#2x2ND$zN@R8>Y&v?)2eA$I9_o2Jv`kfue-RpLpw!gi(y}8xh1*g0HV2iBE
zUr9z-rboIN#Uz5ybc9!ckO*W9m<!4DdI%*X;3B0A_^$9gx9xOryNey?#C1Jq%X8XK
zONG6yg^eiZGPT&azf#fDPiOUNG!IodOBH^|WL#sxI1z|vX&O=pJY?`nq_6VE472ww
zX4)Cm#P%&>JNt(x2ag~0j`toNeRFtnbo``u^zGMs$0$c@p-4JeRf<fZ^b=~{*Z7||
zuSXSGRA=hCny_aPZY|8@4CwVZeq?bhDrXMG1B;?}DW?mwdGEdobKRtFYQm;R4VBXs
zCRUzTsCYnVD6e=b>lo_vpg*l1^jp0iq*%#0rxr{5%|m@(CCPND86f+&>qH2MQh}Vi
z9@?kkAnT*uM~B)KWGr`*ehAC<<;*vUx)6y>P+aZvD_G=(Ws&G#9aF8zeUT*Lh>GRd
zD$~7vCEb&_R%ckgoxE<D-Ab92y3EWmoXH6w>Ii*g3H?RGQclm|3W<q)-?lcZ#UUNb
z+r}(QEekC>^R&#kyuPuK{=22;&o`+jkK{LQ2=gcTWYcnrU(FiTuX+<}{O9Yu@WuaL
z%uh<i)Y=upxsHg5CF1w_RKBd9S)U5^isP8Z$j=yqSma3SMK8a*6d5lPxpuAo^PsQd
z<!fHmiZduQoPO|1A*)1R3VYF%X%hLFV6N{Cjpb9<I#0OcdFO=1QZdgv(UPg4K2arx
z%%`x2$`6J#MZ?WJV)cpDVpbiC)w-dQ!?ut*CrziWno=xdHl86?%l)UfEmH4H^D}~A
zVNNvXS~>aH3je_+dCmz(d6ZH%@6E8O*$7TQw79%$xX_~Tt@wWfez}`4gBSn+w`LNI

literal 1060
zcmV+<1l#*TRzV<BZeeh9Xm4~Nb~6eC0Hq<9n)W7@hc>Qq_UN>STu^@jIt)OP3QH@o
z*UdRcP#=p300000000B+n9pz9HWbI>6~ll41=icJ4jT~+aJpKlrDS#@v_;b)O>)>$
zWGR*o7(Ci~c34ZIN>WY=^ib@&+pxp1TYKsM)xTu?A=~02*=dvk18QF^P}F;0z0X&C
z5?}YbA?*$MA8$Yq5yBb5Jwa&f1duT3VF7_d;v^M(O#l~b&p6>RPWTBG{I@qjfCc{k
z+R`UW>R0=C>BbU-xC>#QivSoi6Q0&^e#%FOHJl_J5}<dl{zP?iTt|eXX-<UW0G*OB
zL|s4(B07>|Bt{tZQ;{-2BVb(0TtiPd=opTU5pw}JSX)jQ8Ob=EA-phIas$;;Wq}+M
zXq=A^NzxH?2yutONdB9w=Z350R^c2S&Y6VE6imxbQ!!?FGr}ZxBEmU|2aYLHDaPY(
z^N?!weMMc0dY%%NDUGQ>JWZ02K;R=2uYh-%A#%z-x0KP-7+ATmT}#;3?*7r<lZTzd
zoyP}1?jIc-KJ6U*^ux{}%Az$;lyad8%0VDOQT?utf4_b?smPL=!(T4gw*)ulRx%g#
zavHy~G%`piCxWsW689{L{<)gYt>&G(D$Qk!x~>HqD-S>z2RJf?7Vq>i3FQ$_Xw0F?
z!t>Tzc>b#CJet6yNCddLw+8Alz(U?K(y~yWGJDdBQYDu|HMoLQqyTkapcS)V@|ERB
z`n)QV4h6YD_O+{62#6Aa+*>}{C1Nk_qV31~+7);tXX0)M%f63;z=<#)`u^aAcih%@
zZP@T0d0SquwdHy{?Y7(OZLV*wZ?w0;ZErr@z{~O~RYh59<+&I~a8Ijvj}S5f9)ZJ!
zx`j(cC=dZ>i8Mdo7QXK_-ImjAJFa`=dA_^hyUm{qP2$cri8>He7AP+F`2{TU(y~ZY
z%_5l>?id3&10qh+u3mZd6^-$EL1{Q7qR>VkJon~>xYM}O$`D%EfB8?bFEAHj_DV4;
zy3F)3CzTyQQ~`Zpfqqc4$mu>@f*8x!GHbFL9FUPbZOpP@IbqqF#WLmc_{v)P-xkl`
zuaYN^<fl*wvpe~C(xQuB%o^pddSh$+@1OIDFFtsfw+mrvc9Z5@1tPT|{+e~=^YqO4
z6x4gRWBG~QOBsV$WRX@UYx%7OWM>}a%FpV*_k&7azGgkO;shoPrysl$WEu1Y*t5DU
zlgPG?GQL;TmXAGaKjCZNKgBGT#C-oqBU4FxSUqCMd<y%hcw<OQG}_E9mhV{2SJkpq
ztr{s=*alMDY01=8Q;9{&Mmb@X+<$!25_NrApCJTuYoaw*s>wH2`Y+DmImH}hSqjyB
emQz!4Avpfh((<X%LM9KsmH!_)WOQb#761SjZTVLK


From 9d3f488e0dc58b9499cf8df76fbc4aef5a3248f8 Mon Sep 17 00:00:00 2001
From: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
Date: Fri, 26 Jan 2024 10:32:02 -0800
Subject: [PATCH 15/15]  build: update dist files

---
 dist/main.cjs | 1 -
 dist/post.cjs | 1 -
 2 files changed, 2 deletions(-)

diff --git a/dist/main.cjs b/dist/main.cjs
index 398e9755..fd717a1a 100644
--- a/dist/main.cjs
+++ b/dist/main.cjs
@@ -10464,7 +10464,6 @@ async function getTokenFromRepository(request2, auth, parsedOwner, parsedReposit
 // lib/request.js
 var import_request = __toESM(require_dist_node5(), 1);
 var request_default = import_request.request.defaults({
-  baseUrl: process.env["GITHUB_API_URL"],
   headers: {
     "user-agent": "actions/create-github-app-token"
   }
diff --git a/dist/post.cjs b/dist/post.cjs
index 9a9249e2..4993573c 100644
--- a/dist/post.cjs
+++ b/dist/post.cjs
@@ -3030,7 +3030,6 @@ function tokenExpiresIn(expiresAt) {
 // lib/request.js
 var import_request = __toESM(require_dist_node5(), 1);
 var request_default = import_request.request.defaults({
-  baseUrl: process.env["GITHUB_API_URL"],
   headers: {
     "user-agent": "actions/create-github-app-token"
   }