From b2a51dd6b4248571722d87a0c27575400cb1844c Mon Sep 17 00:00:00 2001
From: CrazyMax <crazy-max@users.noreply.github.com>
Date: Mon, 12 Jun 2023 07:51:32 +0200
Subject: [PATCH] git: use GitHub API for remoteSha if token provided

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
---
 __tests__/git.test.ts |  5 ++++-
 package.json          |  1 +
 src/buildx/install.ts |  2 +-
 src/git.ts            | 30 +++++++++++++++++++++++++++++-
 yarn.lock             | 28 ++++++++++++++++++++++++++++
 5 files changed, 63 insertions(+), 3 deletions(-)

diff --git a/__tests__/git.test.ts b/__tests__/git.test.ts
index 9db8f2ed..1ba2f7eb 100644
--- a/__tests__/git.test.ts
+++ b/__tests__/git.test.ts
@@ -66,9 +66,12 @@ describe('isInsideWorkTree', () => {
 });
 
 describe('remoteSha', () => {
-  it('returns git remote sha', async () => {
+  it('returns sha using git ls-remote', async () => {
     expect(await Git.remoteSha('https://github.com/docker/buildx.git', 'refs/pull/648/head')).toEqual('f11797113e5a9b86bd976329c5dbb8a8bfdfadfa');
   });
+  it('returns sha using github api', async () => {
+    expect(await Git.remoteSha('https://github.com/docker/buildx.git', 'refs/pull/648/head', process.env.GITHUB_TOKEN)).toEqual('f11797113e5a9b86bd976329c5dbb8a8bfdfadfa');
+  });
 });
 
 describe('remoteURL', () => {
diff --git a/package.json b/package.json
index 987f5877..bee8f545 100644
--- a/package.json
+++ b/package.json
@@ -51,6 +51,7 @@
     "@actions/http-client": "^2.0.1",
     "@actions/io": "^1.1.2",
     "@actions/tool-cache": "^2.0.1",
+    "@octokit/plugin-rest-endpoint-methods": "^7.2.1",
     "async-retry": "^1.3.3",
     "csv-parse": "^5.4.0",
     "handlebars": "^4.7.7",
diff --git a/src/buildx/install.ts b/src/buildx/install.ts
index a99d238b..9279327f 100644
--- a/src/buildx/install.ts
+++ b/src/buildx/install.ts
@@ -73,7 +73,7 @@ export class Install {
     if (ref.match(/^[0-9a-fA-F]{40}$/)) {
       vspec = ref;
     } else {
-      vspec = await Git.remoteSha(repo, ref);
+      vspec = await Git.remoteSha(repo, ref, process.env.GIT_AUTH_TOKEN);
     }
     core.debug(`Install.build: tool version spec ${vspec}`);
 
diff --git a/src/git.ts b/src/git.ts
index 5a0306ce..1ed9c55b 100644
--- a/src/git.ts
+++ b/src/git.ts
@@ -14,8 +14,14 @@
  * limitations under the License.
  */
 
+import * as core from '@actions/core';
+import {Octokit} from '@octokit/core';
+import {restEndpointMethods} from '@octokit/plugin-rest-endpoint-methods';
+
 import {Exec} from './exec';
+import {GitHub} from './github';
 import {Context} from '@actions/github/lib/context';
+
 import {Context as GitContext} from './types/git';
 
 export class Git {
@@ -36,7 +42,29 @@ export class Git {
       });
   }
 
-  public static async remoteSha(repo: string, ref: string): Promise<string> {
+  public static async remoteSha(repo: string, ref: string, token?: string): Promise<string> {
+    const repoMatch = repo.match(/github.com\/([^/]+)\/([^/]+?)(?:\.git)?(\/|$)/);
+    // if we have a token and this is a GitHub repo we can use the GitHub API
+    if (token && repoMatch) {
+      core.setSecret(token);
+      const octokit = new (Octokit.plugin(restEndpointMethods).defaults({
+        baseUrl: GitHub.apiURL
+      }))({auth: token});
+      const [owner, repoName] = repoMatch.slice(1, 3);
+      try {
+        return (
+          await octokit.rest.repos.listCommits({
+            owner: owner,
+            repo: repoName,
+            sha: ref,
+            per_page: 1
+          })
+        ).data[0].sha;
+      } catch (e) {
+        throw new Error(`Cannot find remote ref for ${repo}#${ref}: ${e.message}`);
+      }
+    }
+    // otherwise we fall back to git ls-remote
     return await Git.exec(['ls-remote', repo, ref]).then(out => {
       const [rsha] = out.split(/[\s\t]/);
       if (rsha.length == 0) {
diff --git a/yarn.lock b/yarn.lock
index c7dc3f04..711fd24d 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -810,6 +810,7 @@ __metadata:
     "@actions/http-client": ^2.0.1
     "@actions/io": ^1.1.2
     "@actions/tool-cache": ^2.0.1
+    "@octokit/plugin-rest-endpoint-methods": ^7.2.1
     "@types/csv-parse": ^1.2.2
     "@types/node": ^16.18.21
     "@types/semver": ^7.5.0
@@ -1348,6 +1349,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@octokit/openapi-types@npm:^18.0.0":
+  version: 18.0.0
+  resolution: "@octokit/openapi-types@npm:18.0.0"
+  checksum: d487d6c6c1965e583eee417d567e4fe3357a98953fc49bce1a88487e7908e9b5dbb3e98f60dfa340e23b1792725fbc006295aea071c5667a813b9c098185b56f
+  languageName: node
+  linkType: hard
+
 "@octokit/openapi-types@npm:^7.0.0":
   version: 7.0.0
   resolution: "@octokit/openapi-types@npm:7.0.0"
@@ -1378,6 +1386,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@octokit/plugin-rest-endpoint-methods@npm:^7.2.1":
+  version: 7.2.1
+  resolution: "@octokit/plugin-rest-endpoint-methods@npm:7.2.1"
+  dependencies:
+    "@octokit/types": ^9.3.1
+  peerDependencies:
+    "@octokit/core": ">=3"
+  checksum: 069e52305f9d2e85fb83819a80860e526b9da2e0936640975f749a2c63020674053e6f4b5af771651a93320172579b0779bf3d663c8adcd090f152aac29f4ad4
+  languageName: node
+  linkType: hard
+
 "@octokit/request-error@npm:^2.0.0":
   version: 2.0.2
   resolution: "@octokit/request-error@npm:2.0.2"
@@ -1468,6 +1487,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@octokit/types@npm:^9.3.1":
+  version: 9.3.1
+  resolution: "@octokit/types@npm:9.3.1"
+  dependencies:
+    "@octokit/openapi-types": ^18.0.0
+  checksum: 56fce104114730553c79175261f288a263055af4a6de848130fa964940460ee4fe8fa610f33dd0862c2c178d7d97f703e44a799898f3b52583e7ce5ae595f8ff
+  languageName: node
+  linkType: hard
+
 "@sinclair/typebox@npm:^0.25.16":
   version: 0.25.24
   resolution: "@sinclair/typebox@npm:0.25.24"