GitHub Actionsの実行遅延をCloud SchedulerとCloud Workflowsで解消する

Cloud Scheduler (Asia/Tokyo, 55 11 * * 1-5)
  └─ Cloud Workflows
       ├─ Secret ManagerからGitHub App ID / Installation IDを取得
       ├─ Cloud KMS asymmetricSignでJWT (RS256) を署名
       │    └─ GitHub App private keyはCloud KMSにasymmetric keyとしてimport済み
       ├─ POST https://api.github.com/app/installations/{id}/access_tokens
       │    └─ installation tokenを取得
       └─ POST https://api.github.com/repos/{org}/{repo}/actions/workflows/{workflow}.yml/dispatches
             └─ GitHub Actionsを起動 (既存のラベル付けスクリプトが走る)

resource "google_kms_key_ring" "workflows" {
  name     = "workflows"
  location = var.region
}

resource "google_kms_crypto_key" "github_app" {
  name     = "github-app-private-key"
  key_ring = google_kms_key_ring.workflows.id
  purpose  = "ASYMMETRIC_SIGN"

  # 既存の GitHub App private key を後から import するため初期バージョンは作らない
  skip_initial_version_creation = true

  version_template {
    algorithm        = "RSA_SIGN_PKCS1_2048_SHA256"
    protection_level = "SOFTWARE"
  }
}

resource "google_kms_crypto_key_iam_member" "github_app_signer" {
  for_each = toset([
    "prod-serviceaccount@{project}.iam.gserviceaccount.com",
    "test-serviceaccount@{project}.iam.gserviceaccount.com",
  ])

  crypto_key_id = google_kms_crypto_key.github_app.id
  role          = "roles/cloudkms.signerVerifier"
  member        = "serviceAccount:${each.value}"
}

# 1. import job を作成する。AES wrapping を含む -aes-256 つきを使う。
gcloud kms import-jobs create import-github-app \
  --location=us-central1 --keyring=workflows \
  --import-method=rsa-oaep-3072-sha256-aes-256 --protection-level=software

# 2. import job が ACTIVE になるまで数分待つ。
gcloud kms import-jobs describe import-github-app \
  --location=us-central1 --keyring=workflows \
  --format='value(state)'

# 3. private key を Secret Manager から取得して PKCS#8 DER に変換する。
#    Secret Manager 上は GitHub から download した PKCS#1 PEM 形式だが、
#    --target-key-file は PKCS#8 DER binary を要求するため変換が必要。
gcloud secrets versions access latest \
  --secret=github-app-private-key-secret \
  --out-file=/tmp/gh_app.pem
openssl pkcs8 -topk8 -nocrypt -inform PEM -in /tmp/gh_app.pem -outform DER -out /tmp/gh_app.der

# 4. private key を import する。
gcloud kms keys versions import \
  --import-job=import-github-app \
  --location=us-central1 --keyring=workflows \
  --key=github-app-private-key \
  --algorithm=rsa-sign-pkcs1-2048-sha256 \
  --target-key-file=/tmp/gh_app.der

# 5. 一時ファイルを削除する。
rm /tmp/gh_app.pem /tmp/gh_app.der

main:
  params: [args]
  steps:
    - init:
        assign:
          - project_id: ${sys.get_env("GOOGLE_CLOUD_PROJECT_ID")}
          - github_app_id_secret: ${args.github_app_id_secret}
          - github_app_installation_id_secret: ${args.github_app_installation_id_secret}
          - kms_key_version_name: ${args.kms_key_version_name}
          - target_repo: ${args.target_repo}
          - target_workflow_file: ${args.target_workflow_file}
          - target_ref: ${args.target_ref}

    - get_github_app_id_secret:
        call: googleapis.secretmanager.v1.projects.secrets.versions.access
        args:
          name: ${"projects/" + project_id + "/secrets/" + github_app_id_secret + "/versions/latest"}
        result: app_id_secret_response
    - decode_github_app_id:
        assign:
          - github_app_id: ${int(text.decode(base64.decode(app_id_secret_response.payload.data)))}

    - get_github_app_installation_id_secret:
        call: googleapis.secretmanager.v1.projects.secrets.versions.access
        args:
          name: ${"projects/" + project_id + "/secrets/" + github_app_installation_id_secret + "/versions/latest"}
        result: installation_id_secret_response
    - decode_github_app_installation_id:
        assign:
          - github_app_installation_id: ${text.decode(base64.decode(installation_id_secret_response.payload.data))}

    - build_jwt_header_and_payload:
        assign:
          - now_seconds: ${int(sys.now())}
          - jwt_header_obj:
              alg: "RS256"
              typ: "JWT"
          - jwt_payload_obj:
              iat: ${now_seconds - 60}
              exp: ${now_seconds + 480}
              iss: ${github_app_id}
          - jwt_header_json: ${json.encode_to_string(jwt_header_obj)}
          - jwt_payload_json: ${json.encode_to_string(jwt_payload_obj)}
          - jwt_header_b64_std: ${base64.encode(text.encode(jwt_header_json))}
          - jwt_payload_b64_std: ${base64.encode(text.encode(jwt_payload_json))}
          - jwt_header_b64: ${text.replace_all(text.replace_all(text.replace_all(jwt_header_b64_std, "+", "-"), "/", "_"), "=", "")}
          - jwt_payload_b64: ${text.replace_all(text.replace_all(text.replace_all(jwt_payload_b64_std, "+", "-"), "/", "_"), "=", "")}
          - jwt_signing_input: ${jwt_header_b64 + "." + jwt_payload_b64}
          - jwt_signing_input_b64: ${base64.encode(text.encode(jwt_signing_input))}

    - sign_jwt_with_kms:
        call: http.post
        args:
          url: '${"https://cloudkms.googleapis.com/v1/" + kms_key_version_name + ":asymmetricSign"}'
          auth:
            type: OAuth2
          body:
            data: ${jwt_signing_input_b64}
        result: kms_sign_response

    - assemble_jwt:
        assign:
          - jwt_signature_b64_std: ${kms_sign_response.body.signature}
          - jwt_signature_b64: ${text.replace_all(text.replace_all(text.replace_all(jwt_signature_b64_std, "+", "-"), "/", "_"), "=", "")}
          - jwt: ${jwt_signing_input + "." + jwt_signature_b64}

    - exchange_jwt_for_installation_token:
        call: http.post
        args:
          url: '${"https://api.github.com/app/installations/" + github_app_installation_id + "/access_tokens"}'
          headers:
            Authorization: ${"Bearer " + jwt}
            Accept: "application/vnd.github+json"
            X-GitHub-Api-Version: "2022-11-28"
            User-Agent: "google-cloud-workflows"
        result: installation_token_response
    - extract_installation_token:
        assign:
          - installation_token: ${installation_token_response.body.token}

    - dispatch_workflow:
        call: http.post
        args:
          url: '${"https://api.github.com/repos/" + target_repo + "/actions/workflows/" + target_workflow_file + "/dispatches"}'
          headers:
            Authorization: ${"Bearer " + installation_token}
            Accept: "application/vnd.github+json"
            X-GitHub-Api-Version: "2022-11-28"
            User-Agent: "google-cloud-workflows"
          body:
            ref: ${target_ref}
        result: dispatch_response

    - log_dispatched:
        call: sys.log
        args:
          text: '${"Dispatched workflow " + target_repo + " " + target_workflow_file + " ref=" + target_ref}'
          severity: INFO
    - return_result:
        return: '${"dispatched: " + target_repo + " " + target_workflow_file}'

ERROR: ('target-key-file', "The file is larger than the import method's maximum size of 318 bytes.")

openssl pkcs8 -topk8 -nocrypt -inform PEM -in /tmp/gh_app.pem -outform DER -out /tmp/gh_app.der