Documentation
¶
Index ¶
- func NewCredentialsProvider(_ context.Context, logger logr.Logger) (*credentialsProvider, error)
- func ParsePrivateKey(pemBytes []byte) (*rsa.PrivateKey, error)
- func WithAppID(id int64) option.Option
- func WithBaseURL(url string) option.Option
- func WithHTTPClient(client *http.Client) option.Option
- func WithInstallationID(id int64) option.Option
- func WithPermissions(perms *github.InstallationPermissions) option.Option
- func WithPrivateKey(key *rsa.PrivateKey) option.Option
- func WithRepositories(names []string) option.Option
- func WithRepositoryIDs(ids []int64) option.Option
- func WithTracerProvider(tracerProvider trace.TracerProvider) option.Option
- type CredentialsOption
- type CredentialsProvider
- type Provider
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewCredentialsProvider ¶
NewCredentialsProvider creates a new GitHub App installation token provider.
func ParsePrivateKey ¶
func ParsePrivateKey(pemBytes []byte) (*rsa.PrivateKey, error)
ParsePrivateKey parses a PEM-encoded RSA private key. It accepts both PKCS#1 ("RSA PRIVATE KEY") and PKCS#8 ("PRIVATE KEY" wrapping an RSA key) blocks. Non-RSA keys and non-PEM inputs return an error.
func WithBaseURL ¶
WithBaseURL sets the GitHub API base URL. Defaults to https://api.github.com. Set this for GitHub Enterprise Server, e.g. "https://github.example.com/api/v3".
func WithHTTPClient ¶
WithHTTPClient sets the HTTP client used for token-mint requests. Defaults to http.DefaultClient. Use this to control TLS, proxies, timeouts, or retries. Only the Transport and Timeout are honored; Jar and CheckRedirect are not propagated, since this provider does not use cookies and never follows redirects.
func WithInstallationID ¶
WithInstallationID sets the GitHub App installation ID to mint a token for. Required.
func WithPermissions ¶
func WithPermissions(perms *github.InstallationPermissions) option.Option
WithPermissions narrows the issued installation token to a subset of the App's installation permissions (e.g. &github.InstallationPermissions{Contents: github.String("read")}). Pass nil to omit (the issued token will carry the App's full installation permissions). Values are passed through to GitHub unchecked; GitHub returns 422 for invalid combinations.
func WithPrivateKey ¶
func WithPrivateKey(key *rsa.PrivateKey) option.Option
WithPrivateKey sets the App's RSA private key used to sign the App JWT. Required. Use ParsePrivateKey to obtain a *rsa.PrivateKey from PEM bytes.
func WithRepositories ¶
WithRepositories scopes the issued installation token to specific repositories in the installation's account. Pass bare repository names (no "owner/" prefix). Mutually exclusive with WithRepositoryIDs.
func WithRepositoryIDs ¶
WithRepositoryIDs scopes the issued installation token to specific repositories by numeric ID. Mutually exclusive with WithRepositories.
func WithTracerProvider ¶
func WithTracerProvider(tracerProvider trace.TracerProvider) option.Option
WithTracerProvider sets the OTel TracerProvider used to emit credential.fetch spans. If not set, the tracer falls back to the current span's TracerProvider (if any), then the OTel global TracerProvider.
Types ¶
type CredentialsOption ¶
type CredentialsOption interface {
Apply(*credentialsConfig)
}
CredentialsOption is the interface implemented by all githubapp options.
type CredentialsProvider ¶
type CredentialsProvider interface {
GetCredentials(ctx context.Context, opts ...option.Option) (<-chan credential.Result, error)
}
CredentialsProvider issues GitHub App installation access tokens.
Each call to GetCredentials starts a goroutine that mints a token, sends it on the returned channel as a credential.Update event, and refreshes it before expiry. On any error the loop exits, an error result is sent, and the channel is closed — caller is responsible for restart/retry. The loop also exits when the context is cancelled.
Source Files