[alpoi]

Summary

Lets the plugin authenticate as a GitHub App installation as an alternative to a token. Organizations can govern apps centrally, and the plugin only holds short-lived installation tokens, which ghinstallation renews as they expire.

This is the same change as compliance-framework/plugin-github-repositories#43, which re-implements @gusfcarvalho's compliance-framework/plugin-github-repositories#3. It uses the same config keys:

plugins:
  dependabot:
    config:
      app_id: "123456"
      installation_id: "78901234"
      private_key_file: /etc/ccf/github-app.pem   # or private_key: <PEM or base64 PEM>
      organization: octocat

Changes

• auth.go: AuthConfig is embedded in PluginConfig (mapstructure:",squash", so the keys stay flat) and carried on ParsedConfig.Auth, which replaces ParsedConfig.Token. It validates the credentials and builds the authenticated http.Client behind the go-github client.

• Behaviour for existing configs is unchanged:

  • token still wins when set.
  • With no credentials at all, the plugin still calls GitHub unauthenticated, as before.
  • Only incomplete app credentials are a Configure error (for example GitHub App authentication needs installation_id).

• main_integration_test.go: the PluginConfig literals now set AuthConfig{Token: ...}.

• Tests for validation, the token, file, base64 and PEM paths, bad input, and decoding of the agent's flat config map. README: an authentication section with a GitHub App setup guide.

• Underscores, not hyphens, unlike included-repositories and the plugin's other keys. The agent fills plugin config from CCF_* environment variables by uppercasing the key and replacing dots only, so a hyphenated app-id would need CCF_PLUGINS_DEPENDABOT_CONFIG_APP-ID, which shells can't set. local-dev and the hosted demo pass credentials this way, for example CCF_PLUGINS_DEPENDABOT_CONFIG_PRIVATE_KEY. The README notes this.

Wiring

• gRPC round trip: auth_grpc_test.go sends Configure through go-plugin's in-process gRPC harness (TestPluginGRPCConn with runner.RunnerV2GRPCPlugin), the same path the agent uses. The agent sends config as a flat map<string, string>, and the plugin decodes it after the gRPC hop, so the embedded AuthConfig (mapstructure:",squash") never affects the wire format. The tests cover the token-only config every deployment sends today, an app config with the empty keys agent configs declare, and incomplete app credentials. Without squash they fail.
• local-dev: compliance-framework/local-dev#135 declares the app keys in the showcase agent config (the agent only fills keys the file declares from CCF_* environment variables) and teaches the demo-go-check-github pre-flight about app credentials.

Testing

• go vet ./..., go vet -tags integration ./... and go test ./... pass.
• golangci-lint v2.11.4 with the shared config reports nothing in the changed lines. The seven warnings it prints are already on main.
• I haven't run it against a real GitHub App installation.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 8cf7b740-a267-4119-bdde-467f7a57d111

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}