Documentation
¶
Overview ¶
Package github is the GitHub credential provider: classic and fine-grained personal access tokens, OAuth and GitHub App tokens.
Classic tokens carry a CRC32 checksum that is verified offline, so a well-formed lookalike is never reported. Verification is one authenticated request; revocation goes through GitHub's unauthenticated endpoint for leaked credentials, which notifies the owner.
Index ¶
- Constants
- func Checksum(random string) string
- type Provider
- func (*Provider) Find(content []byte) []detect.Token
- func (*Provider) Kinds() []detect.KindInfo
- func (*Provider) LocalSources() detect.LocalSources
- func (*Provider) Name() string
- func (p *Provider) Revoke(ctx context.Context, tokens []string) error
- func (p *Provider) Verify(ctx context.Context, tok detect.Token) detect.Verification
Constants ¶
const ( // KindPAT is a classic personal access token (ghp_). KindPAT detect.Kind = "github-pat" // KindOAuth is an OAuth app access token (gho_). KindOAuth detect.Kind = "github-oauth" // KindUserToServer is a GitHub App user-to-server token (ghu_). KindUserToServer detect.Kind = "github-user-to-server" // KindServerToServer is a GitHub App installation token (ghs_). KindServerToServer detect.Kind = "github-server-to-server" // KindRefresh is a GitHub App refresh token (ghr_). KindRefresh detect.Kind = "github-refresh" // KindFineGrained is a fine-grained personal access token (github_pat_). KindFineGrained detect.Kind = "github-fine-grained-pat" )
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Provider ¶
type Provider struct {
// BaseURL is the API root, https://api.github.com by default.
BaseURL string
Client *http.Client
}
Provider implements detect.Provider for GitHub.
func (*Provider) Find ¶
Find implements detect.Provider.
Two substring passes cover all six families: one for the shared "gh" stem of the classic prefixes and one for "github_pat_". Every candidate is then checked for exact shape and (classic families) checksum.
func (*Provider) LocalSources ¶
func (*Provider) LocalSources() detect.LocalSources
LocalSources implements detect.Provider: where gh, hub, Copilot and git itself keep tokens.
func (*Provider) Revoke ¶
Revoke implements detect.Provider through POST /credentials/revoke. The endpoint is unauthenticated on purpose: it is meant for whoever finds a token, not only its owner, and GitHub notifies the owner of every revocation. Tokens are submitted in batches the API accepts; GitHub processes them asynchronously, so a nil error means every batch was accepted, not that the tokens are already dead.
Source Files