feat: refresh OIDC token if expiring

test/helpers.test.ts

@@ -51,6 +51,33 @@ describe('Configure AWS Credentials helpers', {}, () => {
     expect(core.info).toHaveBeenCalledWith(expect.stringContaining('Retry: attempt 1 of 3 failed'));
     helpers.reset();
   });
+  describe('jwtExpiresWithin', {}, () => {
+    // Builds a JWT-shaped string (header.payload.signature) with the given payload. Only the payload
+    // segment is read by the helper; the signature is irrelevant since we never verify it.
+    const makeJwt = (payload: object) => {
+      const encode = (obj: object) => Buffer.from(JSON.stringify(obj)).toString('base64url');
+      return `${encode({ alg: 'RS256' })}.${encode(payload)}.signature`;
+    };
+    it('returns true when the token is already expired', {}, () => {
+      const exp = Math.floor(Date.now() / 1000) - 60;
+      expect(helpers.jwtExpiresWithin(makeJwt({ exp }), 30)).toBe(true);
+    });
+    it('returns true when the token expires within the skew window', {}, () => {
+      const exp = Math.floor(Date.now() / 1000) + 10;
+      expect(helpers.jwtExpiresWithin(makeJwt({ exp }), 30)).toBe(true);
+    });
+    it('returns false when the token is comfortably valid', {}, () => {
+      const exp = Math.floor(Date.now() / 1000) + 900;
+      expect(helpers.jwtExpiresWithin(makeJwt({ exp }), 30)).toBe(false);
+    });
+    it('returns false for a token with no exp claim', {}, () => {
+      expect(helpers.jwtExpiresWithin(makeJwt({ sub: 'foo' }), 30)).toBe(false);
+    });
+    it('returns false for a malformed token', {}, () => {
+      expect(helpers.jwtExpiresWithin('not-a-jwt', 30)).toBe(false);
+      expect(helpers.jwtExpiresWithin('', 30)).toBe(false);
+    });
+  });
   it('can output creds when told to', {}, () => {
     vi.spyOn(core, 'setOutput').mockImplementation(() => {});
     vi.spyOn(core, 'setSecret').mockImplementation(() => {});

test/index.test.ts

@@ -89,6 +89,28 @@ describe('Configure AWS Credentials', {}, () => {
       expect(core.exportVariable).toHaveBeenCalledTimes(5);
       expect(core.setFailed).not.toHaveBeenCalled();
     });
+    it('re-mints the OIDC token when it has expired during retries', {}, async () => {
+      // Helper to build a JWT with a given exp (Unix seconds). Only the payload is read by the action.
+      const makeJwt = (exp: number) => {
+        const encode = (obj: object) => Buffer.from(JSON.stringify(obj)).toString('base64url');
+        return `${encode({ alg: 'RS256' })}.${encode({ exp })}.sig`;
+      };
+      const expiredToken = makeJwt(Math.floor(Date.now() / 1000) - 60);
+      const freshToken = makeJwt(Math.floor(Date.now() / 1000) + 900);
+      // First call returns an already-expired token; the refresh inside the retry loop returns a fresh one.
+      vi.mocked(core.getIDToken).mockResolvedValueOnce(expiredToken).mockResolvedValueOnce(freshToken);
+      mockedSTSClient.on(AssumeRoleWithWebIdentityCommand).resolvesOnce(mocks.outputs.STS_CREDENTIALS);
+      await run();
+      // Token fetched once up front, then re-minted because the first was expired.
+      expect(core.getIDToken).toHaveBeenCalledTimes(2);
+      expect(core.info).toHaveBeenCalledWith(
+        'OIDC token has expired or is about to; requesting a fresh one before AssumeRole.',
+      );
+      // The fresh token is the one actually sent to STS.
+      const call = mockedSTSClient.commandCalls(AssumeRoleWithWebIdentityCommand)[0];
+      expect(call.args[0].input.WebIdentityToken).toBe(freshToken);
+      expect(core.setFailed).not.toHaveBeenCalled();
+    });
   });
 
   describe('IAM User Authentication', {}, () => {