Add create-github-app-token GitHub Action

[rafaelbreno]

This is just a test.

In the current experimental tests that we're running on image-build-* repos we were unable to generate a token that could authenticate the git clone of private repositories, see the error below:

Error: buildx failed with: ERROR: failed to solve: process "/bin/sh -c git clone --depth=1 https://${SRC}.git $GOPATH/src/${PKG}" did not complete successfully: exit code: 128

whole log here

@ital0sant0s was able to fix it by implementing this workflow step:

- name: Generate GitHub App token
  id: generate-token
  env:
    # If you store these in GitHub secrets:
    APP_ID: ${{ env.APP_ID }}          # e.g. numeric app ID
    PRIVATE_KEY: ${{ env.PRIVATE_KEY }} # entire PEM content
    INSTALLATION_ID: 60236498
  run: |
    # Install any needed packages for base64, jq, openssl, etc. (on ubuntu-latest, most are preinstalled)
    # Generate a JWT valid for ~9 minutes
    HEADER=$(echo -n '{"alg":"RS256","typ":"JWT"}' | base64 | tr -d '=' | tr '/+' '_-' | tr -d '\n')
    NOW=$(date +%s)
    EXP=$((NOW+540))  # 9 minutes from now (max allowed is 10)
    PAYLOAD=$(echo -n "{\"iat\":$NOW,\"exp\":$EXP,\"iss\":$APP_ID}" | base64 | tr -d '=' | tr '/+' '_-' | tr -d '\n')
      
    # Sign the header.payload with your private key
    SIGNATURE=$(echo -n "$HEADER.$PAYLOAD" \
      | openssl dgst -sha256 -sign <(echo "$PRIVATE_KEY") \
      | openssl base64 -A \
      | tr -d '=' | tr '/+' '_-' | tr -d '\n')
    
    GH_APP_JWT="$HEADER.$PAYLOAD.$SIGNATURE"

    # Exchange the JWT for an installation token
    INSTALL_TOKEN=$(curl -s -X POST \
      -H "Authorization: Bearer $GH_APP_JWT" \
      -H "Accept: application/vnd.github+json" \
      https://api.github.com/app/installations/$INSTALLATION_ID/access_tokens \
      | jq -r '.token')
    # Expose the token as an output so other steps can use it
    echo "app_token=$INSTALL_TOKEN" >> $GITHUB_OUTPUT 

As this seems to be a problem related to actions/create-github-app-token this solution implements the step's structure.

Was able to run a successful CI with this custom action: https://github.com/rancher/image-build-calico/actions/runs/13138596090/job/36659920510

[rafaelbreno]

No need for this action, as we can just:

- name: "Generate GH App Token"
  id: app-token
  uses: actions/create-github-app-token@v1
  with:
    app-id: ${{ env.APP_ID }}
    private-key: ${{ env.PRIVATE_KEY }}
    repositories: private-repo-name