Method GetCredentials

pkg/credentials/github/app.go:97–139

GetCredentials implements the credentials.Provider interface for GitHub Apps. If the provided data represents a GitHub App installation and any optional constraints specified by the metadata do not prevent it, this method returns an App installation access token that is scoped only to the repository

(
	ctx context.Context,
	req credentials.Request,
)

// an App installation access token that is scoped only to the repository
// specified by repoURL.
func (p *AppCredentialProvider) GetCredentials(
	ctx context.Context,
	req credentials.Request,
) (*credentials.Credentials, error) {
	repoName := p.extractRepoName(req.RepoURL)
	if repoName == "" {
		// Doesn't look like a URL we can do anything with.
		return nil, nil
	}

	// If there's a scope map in the metadata, take it into consideration...
	if scopeMapStr := req.Metadata[kargoapi.AnnotationKeyGitHubTokenScope]; scopeMapStr != "" {
		var scopeMap map[string][]string
		if err := json.Unmarshal([]byte(scopeMapStr), &scopeMap); err != nil {
			return nil, fmt.Errorf("error unmarshaling scope map: %w", err)
		}
		if !slices.Contains(scopeMap[req.Project], repoName) {
			// repoName is NOT one of the scopes the Project is allowed to use.
			return nil, nil
		}
	}

	// Client ID is the newer unique identifier for GitHub Apps. GitHub recommends
	// using this when possible. If no client ID is found in the data map, we will
	// fall back on the old/deprecated unique identifier, App ID.
	appOrClientID := string(req.Data[clientIDKey])
	if appOrClientID == "" {
		appOrClientID = string(req.Data[appIDKey])
	}

	installID, err := strconv.ParseInt(string(req.Data[installationIDKey]), 10, 64)
	if err != nil {
		return nil, fmt.Errorf("error parsing installation ID: %w", err)
	}

	return p.getUsernameAndPassword(
		ctx,
		appOrClientID,
		installID,
		string(req.Data[privateKeyKey]),
		req.RepoURL,
	)
}

// getUsernameAndPassword gets a username (kargo) and password (installation
// access token) for the given app/client ID, installation ID, PEM-encoded