Repository navigation
feat: Add token source for generic auth logic - #4637
stevehipwell wants to merge 3 commits into
Conversation
Signed-off-by: Steve Hipwell <steve.hipwell@gmail.com>
There was a problem hiding this comment.
Code Review
This pull request refactors the client's authentication mechanism to use oauth2.TokenSource and the go-githubauth package, replacing the deprecated BasicAuthTransport and UnauthenticatedRateLimitedTransport with the new WithBasicAuth and WithTokenSource options. It also updates the documentation, examples, and tests accordingly. Feedback was provided regarding the example application, where using term.ReadPassword to read a multi-line PEM private key from standard input will fail; it is recommended to prompt for the file path and read the file instead.
Signed-off-by: Steve Hipwell <steve.hipwell@gmail.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #4637 +/- ##
==========================================
- Coverage 98.62% 98.61% -0.01%
==========================================
Files 199 199
Lines 18700 18663 -37
==========================================
- Hits 18442 18405 -37
Misses 258 258 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Signed-off-by: Steve Hipwell <steve.hipwell@gmail.com>
This PR updates the token focused logic added in #4564 with more generic logic that will support non-fixed token patterns (e.g. app auth) via a
oauth2.TokenSource(as mentioned in #4365). This pattern allows us to be specific about the way that authentication should be configured for the client.As part of this work I've removed the
BasicAuthTransportas it's use case is no longer required due to the API no longer supporting basic auth. I've also removed theUnauthenticatedRateLimitedTransportwhich can be replaced with the newgithub.WithBasicAuthoption that integrates with the client URLs and wont cause unintended consequences if the client is cloned. I've also removed reference to the github.com/bradleyfalzon/ghinstallation package which doesn't align with the usage ofoauth2.TokenSource.I also needed to remove
WithHTTPClientas this pattern doesn't fit as the client needs to be mutated.As followup for these changes we should be able to stop blocking redirects to protect the auth token (e.g.
DownloadReleaseAssetshould be able to return the asset without passing in an additional client).