From 77747a7774242b0c9dff8cb1d9665715e0219cda Mon Sep 17 00:00:00 2001
From: David John Arnold Jr <david.j.arnold.jr@census.gov>
Date: Thu, 23 Jul 2026 10:49:32 -1000
Subject: [PATCH] fixing (#3)

* adding insteadOf

* fix: use --add to preserve both insteadOf rules

* feat: add gh-auth token-authenticated HTTPS insteadOf for terraform init SSH module pulls

- Add github_app_pem_file, github_app_installation_id, github_app_id inputs
- Add CSVD/gh-auth@main step to generate token (conditional on pem_file input)
- Replace unauthenticated broken insteadOf with oauth2-token authenticated HTTPS rewrites
- Mirrors pattern from CSVD/terraform-init action
- Resolves CSVDIES-10490

---------

Co-authored-by: Dave Arnold <user@example.com>
---
 action.yml | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/action.yml b/action.yml
index e18f2de..20ae5df 100644
--- a/action.yml
+++ b/action.yml
@@ -12,6 +12,16 @@ inputs:
   var-file:
     description: 'Path to a Terraform tfvars file'
     required: false
+  github_app_pem_file:
+    description: 'GitHub App PEM file for SSH-to-HTTPS git rewrite during terraform init'
+    required: false
+  github_app_installation_id:
+    description: 'GitHub App Installation ID for SSH-to-HTTPS git rewrite during terraform init'
+    required: false
+  github_app_id:
+    description: 'GitHub App ID for SSH-to-HTTPS git rewrite during terraform init'
+    required: false
+    default: '6'
 
 outputs:
   is_valid:
@@ -30,11 +40,21 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - name: Configure git HTTPS insteadOf SSH
+    - name: Setup GITHUB Credentials
+      id: github_credentials
+      if: ${{ inputs.github_app_pem_file != '' }}
+      uses: CSVD/gh-auth@main
+      with:
+        github_app_pem_file: ${{ inputs.github_app_pem_file }}
+        github_app_installation_id: ${{ inputs.github_app_installation_id }}
+        github_app_id: ${{ inputs.github_app_id }}
+
+    - name: Configure Git HTTPS for Terraform module pulls
+      if: ${{ inputs.github_app_pem_file != '' }}
       shell: bash
       run: |
-        git config --global url."https://github.e.it.census.gov/".insteadOf "ssh://git@github.e.it.census.gov/"
-        git config --global url."https://github.e.it.census.gov/".insteadOf "git@github.e.it.census.gov:"
+        git config --global url."https://oauth2:${{ steps.github_credentials.outputs.github_token }}@github.e.it.census.gov/".insteadOf "git@github.e.it.census.gov:"
+        git config --global url."https://oauth2:${{ steps.github_credentials.outputs.github_token }}@github.e.it.census.gov/".insteadOf "ssh://git@github.e.it.census.gov/"
 
     - name: Terraform Init
       shell: bash