Documentation
¶
Overview ¶
Package github creates the authenticated GitHub API client marge uses.
Index ¶
- func AppWriteAccess(client *github.Client) func(ctx context.Context, owner, repo string) (bool, error)
- func AuthenticatedLogin(ctx context.Context, client *github.Client) (string, error)
- func LoadToken(ctx context.Context) string
- func NewAppClient(app *App, baseURL string, httpClient *http.Client) (*github.Client, error)
- func NewClient(ctx context.Context) (*github.Client, error)
- type App
- type InstallationToken
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AppWriteAccess ¶ added in v0.19.2
func AppWriteAccess(client *github.Client) func(ctx context.Context, owner, repo string) (bool, error)
AppWriteAccess returns a check of whether the App installation behind the client may write to a repository, or nil when the client authenticates with a person's token. A nil result is the signal to keep reading permissions.push from the repository, which is the only answer a user token has.
The check reads the permissions GitHub reports when it mints the token the call would carry, so it describes that token and nothing else. The token is already minted for every repository the sweep touches, so the check costs no extra request.
func AuthenticatedLogin ¶ added in v0.19.0
AuthenticatedLogin returns the login the client acts as. An installation token has no user behind it, so GET /user answers 403 and the App's own slug names the bot instead.
func LoadToken ¶
LoadToken returns the GitHub token from GITHUB_TOKEN, GH_TOKEN or, failing both, the GitHub CLI's own login (`gh auth token`). It returns "" when none of them yields a token.
func NewAppClient ¶ added in v0.19.0
NewAppClient returns a client that authenticates as the App against baseURL. A nil httpClient uses the default transport. Only the tests pass either argument; NewClient supplies GitHub's own.
Types ¶
type App ¶ added in v0.19.0
App is the sweep GitHub App's credential. It mints installation tokens on demand and holds no token beyond the life of the process.
func LoadApp ¶ added in v0.19.0
LoadApp returns the App credential the environment carries, or nil when it carries none, which is not an error: the token path serves a person running the CLI. A partial credential is an error, because it is a misconfigured unattended run and not a person's shell.
func (*App) JWT ¶ added in v0.19.0
JWT returns the App JWT that authenticates marge as the App itself, which is what the token mint and GET /app accept.
func (*App) MintToken ¶ added in v0.19.0
func (a *App) MintToken(ctx context.Context, httpClient *http.Client, baseURL string, repos []string) (InstallationToken, error)
MintToken returns an installation token for the named repositories. GitHub scopes the token to those repositories alone: every other repository of the installation answers 404 under it.
type InstallationToken ¶ added in v0.19.2
InstallationToken is one minted token, the moment it stops working, and the permissions GitHub reports for it. The permissions are the token's own authority, which is the only trustworthy answer to what an installation may do: GET /repos reports permissions for the authenticated user, and an installation token has no user behind it.
Source Files