Documentation
¶
Overview ¶
Package githubapp writes the secrets of a GitHub environment as a GitHub App, for the key rotation job (ADR 0007): it signs a JWT of the App with its private key, trades it for an installation token restricted to one repository and to writing its environments, and seals each secret for the public key of the environment.
Every request goes to api.github.com through the platform HTTP client. No error of this package quotes the private key, a token or a secret.
Index ¶
Constants ¶
const APIVersion = "2026-03-10"
APIVersion is the version of the REST API the requests ask for, the one the documentation of the calls gives (docs.github.com, read on 05/11/2026).
const Host = "api.github.com"
Host is the host of the GitHub REST API, the only one the App client may reach.
Variables ¶
var ErrInvalidOptions = errors.New("invalid GitHub App options")
ErrInvalidOptions means NewEnvironmentSecrets was given Options it cannot use. Its errors never quote the private key.
Functions ¶
This section is empty.
Types ¶
type EnvironmentSecrets ¶
type EnvironmentSecrets struct {
// contains filtered or unexported fields
}
EnvironmentSecrets writes a key to two secrets of a GitHub environment, as a GitHub App (ADR 0007). It implements app.CredentialInstaller.
func NewEnvironmentSecrets ¶
func NewEnvironmentSecrets(opts Options) (*EnvironmentSecrets, error)
NewEnvironmentSecrets returns EnvironmentSecrets of opts, or ErrInvalidOptions.
func (*EnvironmentSecrets) InstallCredential ¶
func (s *EnvironmentSecrets) InstallCredential(ctx context.Context, c app.Credential) error
InstallCredential writes the two halves of c to their secrets, each sealed for the public key of the environment. The workflows that read them get c from their next run.
type Options ¶
type Options struct {
// HTTP sends the requests. Required.
HTTP Sender
// APIURL is the base URL of the REST API; "https://" + Host when
// empty.
APIURL string
// ClientID identifies the App, as GitHub recommends for the issuer of
// its JWT; InstallationID is its installation on Owner.
ClientID string
InstallationID int64
// PrivateKey is a private key of the App, in PEM PKCS#1. Required.
PrivateKey []byte
// Owner, Repo and Environment name the GitHub environment whose
// secrets AccessName and SecretName receive the two halves of a key.
Owner, Repo, Environment string
AccessName, SecretName string
// Now tells the time the JWT is issued at; time.Now when nil.
Now func() time.Time
}
Options configures EnvironmentSecrets.
type Sender ¶
type Sender interface {
Send(ctx context.Context, method, rawURL string, header http.Header, body []byte) ([]byte, error)
}
Sender sends a request: the platform client, which allows Host only, bounds time and response size, retries 429 and 5xx answers and returns any other non-2xx answer as a *httpclient.StatusError.
Source Files