Skip to content

Commit 6e66950

Browse files
githubofkrishnadhasgithubofkrishnadhas
authored
v2 version of action - githubofkrishnadhas/github-access-using-githubapp (#6)
* DEVOPS-265 update python image from 3.10 to 3.11 * DEVOPS-265 incorporated new variables to action workfow updated * DEVOPS-265 Updated entrypoint script to pass new vars to python * DEVOPS-265 updated readme * DEVOPS-265 generate jwt and access token updated py filr * DEVOPS-265 added codeql and dependabot for action repo * DEVOPS-265 fix python env issue * generate token fix * generate token fix * generate token fix * generate token fix and entry point eval * remove commented items * adding token to github output to be used as steps.app-token.outputs.token * slight modification on output token * token name issue fixed * githubapp installation token set to GITHUB_OUTPUT instead of GITHUB_ENV allowing multiple token generations * Updated README.md DEVOPS-265
1 parent 13a63d1 commit 6e66950

File tree

6 files changed

+286
-79
lines changed

6 files changed

+286
-79
lines changed

‎.github/dependabot.yml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "pip"
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
# Assignees to set on pull requests
8+
assignees:
9+
- "githubofkrishnadhas"
10+
# prefix specifies a prefix for all commit messages. When you specify a prefix for commit messages,
11+
# GitHub will automatically add a colon between the defined prefix and the commit message provided the
12+
# defined prefix ends with a letter, number, closing parenthesis, or closing bracket.
13+
commit-message:
14+
prefix: "dependabot python package"
15+
# Raise pull requests for version updates to pip against the `main` branch
16+
target-branch: "main"
17+
# Labels on pull requests for version updates only
18+
labels:
19+
- "pip dependencies"
20+
# Increase the version requirements for Composer only when required
21+
versioning-strategy: increase-if-necessary
22+
# Dependabot opens a maximum of five pull requests for version updates. Once there are five open pull requests from Dependabot,
23+
# Dependabot will not open any new requests until some of those open requests are merged or closed.
24+
# Use open-pull-requests-limit to change this limit.
25+
open-pull-requests-limit: 10

‎Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Container image that runs your code
2-
FROM python:3.10-slim-bullseye
2+
FROM python:3.11-slim-bullseye
33

44
WORKDIR /app
55
# Copies your code file from your action repository to the filesystem path `/` of the container

‎README.md

+114-17
Original file line numberDiff line numberDiff line change
@@ -1,47 +1,144 @@
11
# github-access-using-githubapp
2-
github-access-using-githubapp
32

43
Once your GitHub App is installed on an account, you can make it authenticate as an app installation for API requests.
54
This allows the app to access resources owned by that installation, as long as the app was granted the necessary repository access and permissions.
65
API requests made by an app installation are attributed to the app.
76

8-
:pushpin: This action will help in creating github app installation token for both **user accounts** and **Github organizations**
7+
:pushpin: This action will help in creating GitHub app installation token for both **user accounts** and **Github organizations**
8+
9+
> [!IMPORTANT]
10+
> An installation access token expires after 1 hour. Please find suitable alternative approaches if you have long-running processes..
911
1012
# Parameters of action
11-
| Parameter name | Description | Required |
12-
|----------------|-------------|--------------------|
13-
| github_app_private_key | Github App Private key | :heavy_check_mark: |
14-
| github_app_id | Your GitHub App ID | :heavy_check_mark: |
15-
| github_account_type | Github account whether `user` account or `organization` | :heavy_check_mark: |
13+
| Parameter name | Description | Required |
14+
|----------------|----------------------------------------------------------------------------------------------------------------|-------------------|
15+
| github_app_private_key | Github App Private key | :heavy_check_mark: |
16+
| github_app_id | Your GitHub App ID | :heavy_check_mark: |
17+
| owner | Github account owner name. if not specified takes owner of current repository where action is ran | ❌ |
18+
| repositories | List of github repositores to generte token for. if not specified takes current repository where action is ran. | ❌ |
19+
20+
* Store your `Github App Id` and `Github App Private key` as github secret and pass the secret names as inputs for action.
1621

17-
* Store your `Github App Id` and `Github App Private key` as github secret and pass the secret names as inuts for action.
22+
* ❌ 👉 Means optional values
23+
24+
> [!NOTE]
25+
> If the owner is set but repositories are empty, access will include all repositories for that owner.
26+
> If both the owner and repositories are empty, access will be limited to the current repository.
1827
1928
# What's New
2029

2130
Please refer to the [release](https://github.com/githubofkrishnadhas/github-access-using-githubapp/releases) page for the latest release notes.
2231

23-
# Usage
32+
# Usage
2433
```commandline
25-
- uses: githubofkrishnadhas/github-access-using-githubapp@v1
34+
- uses: githubofkrishnadhas/github-access-using-githubapp@v2
35+
id: token-generation
2636
with:
2737
# Your GitHub App ID - interger value
2838
github_app_id: 1234567
2939
30-
# Github App Private key
40+
# GitHub App Private key
3141
github_app_private_key : ''
3242
33-
# Gituhb account type `user` or `organization` only
34-
github_account_type: ''
43+
# GitHub account Owner name - Optional
44+
owner: ''
45+
46+
# GitHub repositories names seperated by comma if more than 1 - optional
47+
repositories: ''
3548
```
3649

3750
# output
3851

39-
The token generated will be available as a Environment variable `GH_APP_TOKEN` which can be used while running api calls
52+
* The token generated will be available as a ${{ steps.token-generation.outputs.token }} which can be used in later stages as required
53+
54+
# Example usages
55+
56+
## Create a token for the current repository
57+
58+
```commandline
59+
uses: githubofkrishnadhas/github-access-using-githubapp@v2
60+
id: token-generation
61+
with:
62+
github_app_id: ${{ secrets.APP_ID }}
63+
github_app_private_key : ${{ secrets.PRIVATE_KEY }}
64+
```
65+
* To create a Token in the scope of current repository where action is run, you do not need to specify `owner` or `repositores`
66+
* Assuming both GitHub App ID and Private key are present as github secrets with names `APP_ID` and `PRIVATE_KEY`
67+
* You can substitute your secrets names with above
68+
* The token generated will be available as a ${{ steps.token-generation.outputs.token }} which can be used in later stages as required
69+
70+
71+
## Create a token for the current user or organization level
72+
73+
```commandline
74+
uses: githubofkrishnadhas/github-access-using-githubapp@v2
75+
id: token-generation
76+
with:
77+
github_app_id: ${{ secrets.APP_ID }}
78+
github_app_private_key : ${{ secrets.PRIVATE_KEY }}
79+
owner: 'github'
80+
```
81+
* To create a Token in the scope of current user or organization where your Github app has access, you need only to specify `owner`
82+
* Assuming both GitHub App ID and Private key are present as github secrets with names `APP_ID` and `PRIVATE_KEY`
83+
* You can substitute your secrets names with above
84+
* The token generated will be available as a ${{ steps.token-generation.outputs.token }} which can be used in later stages as required
85+
86+
87+
## Create a token for a differnt user or organization scoped to specific repos
88+
89+
```commandline
90+
uses: githubofkrishnadhas/github-access-using-githubapp@v2
91+
id: token-generation
92+
with:
93+
github_app_id: ${{ secrets.APP_ID }}
94+
github_app_private_key : ${{ secrets.PRIVATE_KEY }}
95+
owner: 'github'
96+
repositories: 'test1,test2,test3'
97+
```
98+
* To create a Token in the scope of provided repositories and owner where your Github app has access you need only to specify `owner` and `repositories`
99+
* The above will generate token which are scoped to repositores named `test1, test2, test3` on `github` org
100+
* Assuming both GitHub App ID and Private key are present as github secrets with names `APP_ID` and `PRIVATE_KEY`
101+
* You can substitute your secrets names with above
102+
* The token generated will be available as a ${{ steps.token-generation.outputs.token }} which can be used in later stages as required
103+
104+
105+
## Using the token generated with other actions
106+
107+
```commandline
108+
name: Clone Repository
109+
110+
on:
111+
workflow_dispatch:
112+
113+
jobs:
114+
clone:
115+
runs-on: ubuntu-latest
116+
117+
steps:
118+
119+
- name: Token generator
120+
uses: githubofkrishnadhas/github-access-using-githubapp@v2
121+
id: token-generation
122+
with:
123+
github_app_id: ${{ secrets.APP_ID }}
124+
github_app_private_key : ${{ secrets.PRIVATE_KEY }}
125+
126+
- name: Checkout Repository
127+
uses: actions/checkout@v4
128+
with:
129+
repository: 'devwithkrishna/azure-terraform-modules'
130+
token: ${{ steps.token-generation.outputs.token }}
131+
fetch-depth: 1
132+
```
133+
* The above workflow generates a github app installation access token using the action - `githubofkrishnadhas/github-access-using-githubapp@v2`
134+
* The token generated will be available as a ${{ steps.token-generation.outputs.token }} which can be used in later stages as shown above
135+
* The workflow is to clone a repository named `azure-terraform-modules` inside `devwithkrishna` organization
136+
40137

41138
# References
42139

43-
[generating-an-installation-access-token](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app#generating-an-installation-access-token)
44-
[get-a-user-installation-for-the-authenticated-app](https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#get-a-user-installation-for-the-authenticated-app)
45-
[get-a-repository-installation-for-the-authenticated-app](https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#get-a-repository-installation-for-the-authenticated-app)
140+
* [generating-an-installation-access-token](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app#generating-an-installation-access-token)
141+
* [get-a-user-installation-for-the-authenticated-app](https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#get-a-user-installation-for-the-authenticated-app)
142+
* [get-a-repository-installation-for-the-authenticated-app](https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#get-a-repository-installation-for-the-authenticated-app)
46143

47144
All the above API's uses [JWT](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/about-authentication-with-a-github-app#authenticating-as-a-github-app) as access token.

‎action.yml

+10-3
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,19 @@ inputs:
1010
required: true
1111
github_app_private_key:
1212
description: "Github App private key"
13-
github_account_type:
14-
description: "Github account user or organization"
13+
required: true
14+
owner:
15+
description: "The owner of the GitHub App installation. If empty, defaults to the current repository owner"
16+
required: false
17+
repositories:
18+
description: "Comma-separated list of repositories to grant access to"
19+
required: false
20+
1521
runs:
1622
using: 'docker'
1723
image: 'Dockerfile'
1824
args:
1925
- ${{ inputs.github_app_id }}
2026
- ${{ inputs.github_app_private_key }}
21-
- ${{ inputs.github_account_type }}
27+
- ${{ inputs.owner }}
28+
- ${{ inputs.repositories }}

‎entrypoint.sh

+21-2
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,26 @@
33
# installng pipenv and creating pipenv venv
44
cd /app && pipenv install --skip-lock
55

6-
# run python program to generate token
7-
pipenv run python3 /app/generate_jwt.py --github_app_id "$1" --github_app_private_key "$2" --github_account_type "$3"
6+
# Capture arguments
7+
GITHUB_APP_ID="$1"
8+
GITHUB_APP_PRIVATE_KEY="$2"
9+
OWNER="$3"
10+
REPOSITORIES="$4"
11+
12+
# Build the command based on available parameters
13+
CMD="pipenv run python3 /app/generate_jwt.py --github_app_id \"$GITHUB_APP_ID\" --github_app_private_key \"$GITHUB_APP_PRIVATE_KEY\""
14+
15+
if [ -n "$OWNER" ]; then
16+
CMD="$CMD --owner \"$OWNER\""
17+
fi
18+
19+
if [ -n "$REPOSITORIES" ]; then
20+
CMD="$CMD --repositories \"$REPOSITORIES\""
21+
fi
22+
23+
# Print and execute the command
24+
echo "Executing command: $CMD"
25+
eval "$CMD"
26+
827

928

0 commit comments

Comments
 (0)