Help us shape the future of Go! Take the 2026 Go Developer Survey

githubapp

package
v0.9.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 28, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Documentation

Overview

Package githubapp mints GitHub App installation tokens: short-lived (one hour) tokens scoped to an installation, and optionally narrowed to some of its repositories and permissions. The operator gives one to a sandboxed agent per run, so the App's private key never leaves the operator.

Index

Constants

View Source
const DefaultAPIURL = "https://api.github.com"

DefaultAPIURL is the GitHub.com REST API.

Variables

This section is empty.

Functions

This section is empty.

Types

type APIError

type APIError struct {
	Status  int
	Message string
}

APIError is a GitHub API error response.

func (*APIError) Error

func (e *APIError) Error() string

func (*APIError) Permanent

func (e *APIError) Permanent() bool

Permanent reports whether retrying cannot help: a 4xx other than rate limiting.

type Client

type Client struct {
	AppID          string
	InstallationID int64
	Key            *rsa.PrivateKey
	// APIURL is the REST API base URL (default DefaultAPIURL; GitHub
	// Enterprise Server uses https://<host>/api/v3).
	APIURL string
	HTTP   *http.Client
	// Now is the clock (default time.Now); tests override it.
	Now func() time.Time
}

Client mints installation tokens for one GitHub App installation.

func FromDir

func FromDir(dir, apiURL string) (*Client, error)

FromDir loads an App from a mounted Secret directory holding app-id, installation-id and private-key (PEM) files.

func New

func New(appID string, installationID int64, privateKeyPEM []byte) (*Client, error)

New parses the App's PEM private key.

func (*Client) InstallationToken

func (c *Client) InstallationToken(ctx context.Context, req TokenRequest) (*Token, error)

InstallationToken mints a token for the installation, narrowed by req.

func (*Client) RevokeToken

func (c *Client) RevokeToken(ctx context.Context, token string) error

RevokeToken revokes an installation token before it expires. A token that is already expired or revoked is not an error.

type Token

type Token struct {
	Value     string
	ExpiresAt time.Time
}

Token is a minted installation token.

type TokenRequest

type TokenRequest struct {
	// Repositories are repository names without the owner (e.g. "agent-orca").
	Repositories []string `json:"repositories,omitempty"`
	// Permissions maps a permission to "read" or "write", e.g. contents: write.
	Permissions map[string]string `json:"permissions,omitempty"`
}

TokenRequest narrows an installation token. Empty fields keep the installation's full scope, so callers should always narrow.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL