Affected by GO-2026-6263 and 1 other vulnerabilities

GO-2026-6263: Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution in github.com/openshift-pipelines/pipelines-as-code

GO-2026-6266: Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header in github.com/openshift-pipelines/pipelines-as-code

app

package

v0.41.0 Latest Latest Go to latest Published: Jan 20, 2026 License: Apache-2.0 Imports: 11 Imported by: 0

Documentation ¶

Index ¶

type Install
- func NewInstallation(req *http.Request, run *params.Run, repo *v1alpha1.Repository, ...) *Install
- func (ip *Install) GenerateJWT(ctx context.Context) (string, error)
- func (ip *Install) GetAndUpdateInstallationID(ctx context.Context) (string, string, int64, error)
type JWTClaim

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Install ¶ added in v0.26.0

type Install struct {
	// contains filtered or unexported fields
}

func NewInstallation ¶ added in v0.26.0

func NewInstallation(req *http.Request, run *params.Run, repo *v1alpha1.Repository, gh *github.Provider, namespace string) *Install

func (*Install) GenerateJWT ¶ added in v0.26.0

func (ip *Install) GenerateJWT(ctx context.Context) (string, error)

GenerateJWT generates a JWT token for the GitHub App. It retrieves the application ID and private key, sets the claims, and signs the token.

func (*Install) GetAndUpdateInstallationID ¶ added in v0.26.0

func (ip *Install) GetAndUpdateInstallationID(ctx context.Context) (string, string, int64, error)

GetAndUpdateInstallationID retrieves and updates the installation ID for the GitHub App. It generates a JWT token, and directly fetches the installation for the repository.

type JWTClaim ¶

type JWTClaim struct {
	Issuer int64 `json:"iss"`
	jwt.RegisteredClaims
}

JWTClaim represents the JWT claims for the GitHub App.

Source Files ¶

View all Source files

token.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL