| 394 | } |
| 395 | |
| 396 | func (g *Github) HTTPClient(ctx context.Context) (*http.Client, error) { |
| 397 | if err := g.Validate(); err != nil { |
| 398 | return nil, fmt.Errorf("invalid github config: %w", err) |
| 399 | } |
| 400 | var roots *x509.CertPool |
| 401 | caBundle, err := g.CACertBundle() |
| 402 | if err != nil { |
| 403 | return nil, fmt.Errorf("fetching CA cert bundle: %w", err) |
| 404 | } |
| 405 | if caBundle != nil { |
| 406 | roots = x509.NewCertPool() |
| 407 | ok := roots.AppendCertsFromPEM(caBundle) |
| 408 | if !ok { |
| 409 | return nil, fmt.Errorf("failed to parse CA cert") |
| 410 | } |
| 411 | } |
| 412 | // nolint:golangci-lint,gosec,godox |
| 413 | // TODO: set TLS MinVersion |
| 414 | httpTransport := &http.Transport{ |
| 415 | TLSClientConfig: &tls.Config{ |
| 416 | RootCAs: roots, |
| 417 | }, |
| 418 | } |
| 419 | |
| 420 | var tc *http.Client |
| 421 | switch g.AuthType { |
| 422 | case GithubAuthTypeApp: |
| 423 | itr, err := ghinstallation.NewKeyFromFile(httpTransport, g.App.AppID, g.App.InstallationID, g.App.PrivateKeyPath) |
| 424 | if err != nil { |
| 425 | return nil, fmt.Errorf("failed to create github app installation transport: %w", err) |
| 426 | } |
| 427 | |
| 428 | tc = &http.Client{Transport: itr} |
| 429 | default: |
| 430 | httpClient := &http.Client{Transport: httpTransport} |
| 431 | ctx = context.WithValue(ctx, oauth2.HTTPClient, httpClient) |
| 432 | |
| 433 | token := g.PAT.OAuth2Token |
| 434 | if token == "" { |
| 435 | token = g.OAuth2Token |
| 436 | } |
| 437 | |
| 438 | ts := oauth2.StaticTokenSource( |
| 439 | &oauth2.Token{AccessToken: token}, |
| 440 | ) |
| 441 | tc = oauth2.NewClient(ctx, ts) |
| 442 | } |
| 443 | |
| 444 | return tc, nil |
| 445 | } |
| 446 | |
| 447 | // Provider holds access information for a particular provider. |
| 448 | // A provider offers compute resources on which we spin up self hosted runners. |