Feature Request > GitHub App authentication support

[kuwas]

Terraform Version

v0.13.0-beta3

Affected Resource(s)

• provider configuration

Terraform Configuration Files

provider "github" {
  app_id          = var.app_id
  private_key_pem = var.private_key_pem
}

Debug Output

n/a, this feature doesn't exist

Panic Output

n/a, this feature doesn't exist

Expected Behavior

Terraform authenticates as a GitHub App, this removes the need of making a bot GitHub account for terraform usage

Actual Behavior

n/a, this feature doesn't exist

Steps to Reproduce

n/a, this feature doesn't exist

Important Factoids

• GitHub Apps has higher API limits than a Personal Access Token
  • https://developer.github.com/apps/building-github-apps/understanding-rate-limits-for-github-apps/#server-to-server-requests

References

• https://developer.github.com/apps/building-github-apps/authenticating-with-github-apps/#authenticating-as-a-github-app
• Improve document about authenticating with GitHub Apps google/go-github#1069

[dutsmiller]

I would add that it would be nice to be able to use repository deployment keys in the same fashion. While this would limit the overall functionality of the provider, it would be nice to not have to tie the use of the provider to a specific user account.

[patrickmarabeas]

It's been on my list to port over - but you can use this provider to auth via Github App, and feed the token into the official Github Terraform provider:

Provider schema: https://github.com/patrickmarabeas/terraform-provider-github-v4/blob/master/github-v4/provider.go#L31

Access the token: https://github.com/patrickmarabeas/terraform-provider-github-v4/blob/master/github-v4/data_source_github_token.go

Beware of the differences in auth and access that Github Apps have.

[jcudit]

Very interested in seeing this one ship. Thanks for getting the discussion started!

[patrickmarabeas]

I'll start working on integrating the functionality: https://github.com/terraform-providers/terraform-provider-github/pull/613

[jspiro]

Is there a simple string I can generate by hand that encodes OAuth2 info in it that will drop-in work in the existing provider? The docs say

token - (Optional) A GitHub OAuth / Personal Access Token. When not provided or made available via the GITHUB_TOKEN environment variable, the provider can only access resources available anonymously.

But I can't figure out what to give it. We're not OAuth2 knowledgable here, so any help or examples would be deeply appreciated. We're hitting our API limits constantly and need to switch over to the GitHub VCS connection established by Terraform.io.

[alloveras]

Hey @patrickmarabeas,
It seems like the link to your PR above is broken (perhaps you ended up discarding it? 😃 )

I started a new one from scratch here. This message is just to make sure we aren't duplicating efforts 😉

[patrickmarabeas]

@alloveras yeah they moved the repo. I haven't done much more, so sweet as 👍