Documentation
¶
Overview ¶
Package githubapp mints GitHub App installation tokens: short-lived (one hour) tokens scoped to an installation, and optionally narrowed to some of its repositories and permissions. The operator gives one to a sandboxed agent per run, so the App's private key never leaves the operator.
Index ¶
Constants ¶
const DefaultAPIURL = "https://api.github.com"
DefaultAPIURL is the GitHub.com REST API.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Client ¶
type Client struct {
AppID string
InstallationID int64
Key *rsa.PrivateKey
// APIURL is the REST API base URL (default DefaultAPIURL; GitHub
// Enterprise Server uses https://<host>/api/v3).
APIURL string
HTTP *http.Client
// Now is the clock (default time.Now); tests override it.
Now func() time.Time
}
Client mints installation tokens for one GitHub App installation.
func FromDir ¶
FromDir loads an App from a mounted Secret directory holding app-id, installation-id and private-key (PEM) files.
func (*Client) InstallationToken ¶
InstallationToken mints a token for the installation, narrowed by req.
type TokenRequest ¶
type TokenRequest struct {
// Repositories are repository names without the owner (e.g. "agent-orca").
Repositories []string `json:"repositories,omitempty"`
// Permissions maps a permission to "read" or "write", e.g. contents: write.
Permissions map[string]string `json:"permissions,omitempty"`
}
TokenRequest narrows an installation token. Empty fields keep the installation's full scope, so callers should always narrow.