Documentation
¶
Overview ¶
Package githubapp 提供 GitHub App 凭证能力：用 App 的 RSA 私钥签发 RS256 JWT（第一层凭证），以及用该 JWT 换取 installation access token（第二层 凭证，实际调 GitHub API 用）。独立成包是为了让 git-sync-core、git-ferry 等下游共享同一实现，删掉各自手写的重复代码。
Index ¶
Constants ¶
const DefaultAPIBase = "https://api.github.com"
DefaultAPIBase 是 GitHub 公有 API 地址；GitHub Enterprise Server 传各自 的域名（如 https://ghe.example.com/api/v3）。
const DefaultRefreshMargin = time.Minute
DefaultRefreshMargin is how long before ExpiresAt a replacement token is fetched. GitHub rejects tokens the instant they expire, so a token used at 59:59.9 fails; refreshing a minute early keeps in-flight requests that obtained the token moments ago inside its validity window.
const DefaultTokenTTL = time.Hour
DefaultTokenTTL is the assumed validity of an installation token when the response omits expires_at. GitHub issues one-hour tokens; assuming the documented default is strictly safer than caching forever.
Variables ¶
This section is empty.
Functions ¶
func FetchInstallationToken ¶
func FetchInstallationToken(ctx context.Context, apiBase string, appID, installationID int64, privateKeyPEM string) (string, error)
FetchInstallationToken 用 JWT 换 installation access token（有效期约 1h）。 apiBase 为空时取 DefaultAPIBase，尾部斜杠会被去掉。
请求走 transport.Client 而不是裸 http.Client，以复用平台统一的重试/日志/ 钩子链路；access_tokens 是不幂等的写操作，默认重试配置只允许"请求根本 没发出去"（DNS/dial 失败）级别的安全重试，不会重放已到达服务端的 POST。
Types ¶
type InstallationTokenSource ¶ added in v0.75.0
type InstallationTokenSource struct {
APIBase string
AppID int64
InstallationID int64
PrivateKeyPEM string
// RefreshMargin, when positive, overrides DefaultRefreshMargin. Tests
// use small values to exercise the expiry paths without sleeping.
RefreshMargin time.Duration
// FallbackTTL, when positive, overrides DefaultTokenTTL for responses
// without expires_at.
FallbackTTL time.Duration
// contains filtered or unexported fields
}
InstallationTokenSource is a caching TokenSource over FetchInstallationToken: it fetches an installation access token once, serves it until shortly before its expires_at, and only then mints a fresh JWT and fetches a replacement. Concurrent callers collapse onto a single fetch (the first one wins, the rest reuse its result), so wiring this straight into provider.Config.TokenSource costs one JWT signature plus one POST per hour — not per request.
src := githubapp.NewInstallationTokenSource("", appID, installationID, pem)
p, err := provider.NewProvider(provider.Config{
Platform: provider.PlatformGitHub,
TokenSource: src, // satisfies provider.TokenSource structurally
})
Refresh failures return the error and leave the cache untouched, so the next call retries; a token already cached is never served past its expiry.
func NewInstallationTokenSource ¶ added in v0.75.0
func NewInstallationTokenSource(apiBase string, appID, installationID int64, privateKeyPEM string) *InstallationTokenSource
NewInstallationTokenSource builds a source for one app installation. apiBase follows FetchInstallationToken's rules (empty = GitHub public API; GHES passes its own /api/v3 root).
func (*InstallationTokenSource) ExpiresAt ¶ added in v0.75.0
func (s *InstallationTokenSource) ExpiresAt() time.Time
ExpiresAt reports when the cached token expires (zero value when nothing has been fetched yet) — for dashboards and tests.
Source Files