Documentation
¶
Overview ¶
Package token finds the token of the ordinary GitHub client and builds the clients ar2 uses beside it.
The ones beside it are GitHub App installation tokens, and both exist because of something the repository's own GITHUB_TOKEN can't do. Neither is required: without them the ordinary client is used, which is what a local run does and what works in a repository with no rulesets.
Index ¶
Constants ¶
const APIEnv = "AR2_API_TOKEN"
APIEnv holds the token GitHub's API is asked with, when it isn't GITHUB_TOKEN.
GITHUB_TOKEN is what the state is read and written with, in the container registry, which a GitHub App installation token can't reach. As the token of the API it is the repository's Actions token, which allows a thousand requests an hour, shared with every workflow of the repository: a chain of runs used it up, and the next run failed before it started, while installing ar2. An installation token of the registry's app has a budget of its own, five times that at least.
const PREnv = "AR2_PR_TOKEN"
PREnv holds the token that commits to the head branches and opens the pull requests.
A pull request opened or updated with GITHUB_TOKEN gets its workflow runs in an approval-required state, so nothing checks it until a person presses a button. A registry that opens pull requests on a schedule would need someone for every one of them, and auto-merge would never fire. A GitHub App installation token doesn't carry that restriction.
The app is not a bypass actor for anything: it opens pull requests and that is all, so the checks still decide what merges.
Variables ¶
This section is empty.
Functions ¶
func API ¶ added in v0.15.17
func API(logger *slog.Logger) (oauth2.TokenSource, error)
API returns the token source the client of GitHub's API uses: APIEnv's token when it is set, and otherwise what GitHub returns.
func GitHub ¶ added in v0.13.2
func GitHub(logger *slog.Logger) (oauth2.TokenSource, error)
GitHub returns the token source the ordinary client uses, or nil when there is none.
GITHUB_TOKEN wins. Without it the token comes from ghtkn when ghtkn is set up, so a local run needs no token in the environment. ghtkn is only asked for a token when a request needs one, and it never starts the device flow: a token that has to be authenticated again is an error naming 'ghtkn auth'.
Types ¶
This section is empty.
Source Files