ACTIONS_TOKEN_ISSUER incompatible with enterprise custom issuer

[jrarmstro]

If an Enterprise administrator has enabled the custom issuer for their enterprise, ACTIONS_TOKEN_ISSUER must be set to https://token.actions.githubusercontent.com/<enterpriseSlug>. However, the JWKS URL remains at https://token.actions.githubusercontent.com/.well-known/jwks. The cache server assumes that the JWKS URL is at $ACTIONS_TOKEN_ISSUER/.well-known/jwks which is untrue in this case.

Errors in the logs appear:

[cache-server-node-1]  ERROR  Response: POST /twirp/github.actions.results.api.v1.CacheService/GetCacheEntryDownloadURL > 401
 Invalid token
    at createError$1 (server/index.mjs:660:15)
    at server/chunks/_/twirp.mjs:38:11
    at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
    at async getCacheScope (server/chunks/_/twirp.mjs:37:19)
    at async Object.handler (server/chunks/routes/twirp/github.actions.results.api.v1.CacheService/GetCacheEntryDownloadURL.post.mjs:45:30)
    at async Object.handler (server/index.mjs:1652:19)
    at async Server.toNodeHandle (server/index.mjs:1930:7)
  [cause]: Expected 200 OK from the JSON Web Key Set HTTP response
      at fetchJwks (server/node_modules/jose/dist/webapi/jwks/remote.js:29:15)
      at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
      at async RemoteJWKSet.reload (server/node_modules/jose/dist/webapi/jwks/remote.js:143:9)
      at async RemoteJWKSet.getKey (server/node_modules/jose/dist/webapi/jwks/remote.js:110:13)
      at async flattenedVerify (server/node_modules/jose/dist/webapi/jws/flattened/verify.js:74:15)
      at async compactVerify (server/node_modules/jose/dist/webapi/jws/compact/verify.js:15:22)
      at async Module.jwtVerify (server/node_modules/jose/dist/webapi/jwt/verify.js:5:22)
      at async getCacheScope (server/chunks/_/twirp.mjs:37:19)
      at async Object.handler (server/chunks/routes/twirp/github.actions.results.api.v1.CacheService/GetCacheEntryDownloadURL.post.mjs:45:30)
      at async Object.handler (server/index.mjs:1652:19)

---

Output from the custom Open ID Discovery Endpoint (https://token.actions.githubusercontent.com/<enterpriseSlug>/.well-known/openid-configuration):

{
  "issuer": "https://token.actions.githubusercontent.com/<enterpriseSlug>",
  "jwks_uri": "https://token.actions.githubusercontent.com/.well-known/jwks",
. . .
}

[LouisHaftmann]

Fixed in latest release: https://github.com/falcondev-oss/github-actions-cache-server/releases/tag/v9.7.0

Check updated docs: https://gha-cache-server.falcondev.io/getting-started#github-enterprise-server-ghes

[jrarmstro]

@LouisHaftmann Interestingly, GitHub doesn't actually appear to include the customized iss in cache JWTs; the rest of our OIDC definitely does use the custom iss, but this fix exposed that the JWT hitting the cache server actually contains

iss: 'https://token.actions.githubusercontent.com/',

This was an error on my end where I assumed the iss customization would apply here. I would recommend a note in the docs that Enterprise customized iss does not apply here.