[FR] GitHub authentication using a GitHub App

[markszabo]

Summary

Looking at the docs it seems that currently only personal access tokens (either fine-grained or classic) are supported as a way to authenticate to GitHub and retrieve private repositories.

Would it be possible to support authenticating via GitHub Apps as well?

Details

The GitHub docs recommend using GitHub Apps over PATs for this type of long-lived integration.

Moreover for GitHub Enterprise Cloud setups, GitHub is charged per user account (which includes service accounts), so many companies will limit the number of service accounts and use GitHub Apps instead for automations.

A GitHub App can be installed on either entire GitHub organizations (including new repos within those orgs) or a selected set of repositories. This would help control the access SourceBot has (compared to a PAT, unless the PAT belongs to a dedicated service account).

The GitHub App has a private key, which can be used to create a temporary access token scoped to either an org or a repository, and then this token can be used to call the GitHub API. This is likely the logic that SourceBot would need to implement. Something like:

1. Let the user choose GitHub App as the authentication method and provide its ID and private key
2. When SourceBot needs to access the GitHub API, instead of simply taking the PAT from the config, it would take the private key, create the token scoped for the specific org, then use that

Since the token is scoped to either a repository or an organization, this means that it will need to be generated per-org (unlike the PAT that works across all orgs), so this is likely additional logic to be implemented.

[brendan-kellam]

Heya - yea this is something that could be supported in Sourcebot. Good callout w.r.t., service accounts being included in seat pricing for GHEC.

Since the token is scoped to either a repository or an organization, this means that it will need to be generated per-org (unlike the PAT that works across all orgs), so this is likely additional logic to be implemented.

Off the top of my head, it sounds like the flow will be (1) Admin creates a GitHub app and links it to Sourcebot, and (2) for that GitHub app, admin creates N app installations for the repos and orgs they want to index. There will need to be some relationship between the app installation and our Connection representation.

[markszabo]

Thanks for the quick reply and putting it on your roadmap!

Off the top of my head, it sounds like the flow will be (1) Admin creates a GitHub app and links it to Sourcebot, and (2) for that GitHub app, admin creates N app installations for the repos and orgs they want to index. There will need to be some relationship between the app installation and our Connection representation.

I believe you are correct. The GitHub API does provide an endpoint to get all installations of an app, so those don't need to be manually configured.