[alpoi]

Summary

Lets the plugin authenticate as a GitHub App installation as an alternative to a token. Organizations can govern apps centrally, and the plugin only holds short-lived installation tokens, which ghinstallation renews as they expire.

This re-implements #3 by @gusfcarvalho, which has conflicts with master. Since then, go-github has moved from v71 to v93 and the plugin gained a GraphQL client. The config keys are unchanged from #3:

plugins:
  github_repos:
    app_id: "123456"
    installation_id: "78901234"
    private_key_file: /etc/ccf/github-app.pem   # or private_key: <PEM or base64 PEM>
    organization: octocat

Changes

• auth.go: AuthConfig (embedded in PluginConfig with mapstructure:",squash", so the keys stay flat), validation, and one authenticated http.Client that backs both the REST and the GraphQL client.
• token still takes precedence when set, so existing configs behave exactly as before.

Differences from #3

• Validation names the missing keys (for example GitHub App authentication needs installation_id), and rejects setting both private_key_file and private_key.
• private_key accepts plain PEM as well as base64-encoded PEM.
• The GraphQL client (added since feat: introduces github app authentication #3) also authenticates as the app.
• Tests: validation, the token, file, base64 and PEM paths, bad input, and decoding of the agent's flat config map.
• README: a GitHub App section, with setup steps.

Wiring

• gRPC round trip: auth_grpc_test.go sends Configure through go-plugin's in-process gRPC harness (TestPluginGRPCConn with runner.RunnerV2GRPCPlugin), the same path the agent uses. The agent sends config as a flat map<string, string>, and the plugin decodes it after the gRPC hop, so the embedded AuthConfig (mapstructure:",squash") never affects the wire format. The tests cover the token-only config every deployment sends today, an app config with the empty keys agent configs declare, and incomplete app credentials. Without squash they fail.
• local-dev: compliance-framework/local-dev#135 declares the app keys in the showcase agent config (the agent only fills keys the file declares from CCF_* environment variables) and teaches the demo-go-check-github pre-flight about app credentials.

Testing

• go vet ./... and go test ./... pass.
• golangci-lint v2.11.4 with the shared config reports nothing in the changed files. The six warnings it prints (deprecated GetSBOM / github.Ptr, one QF1002) are already on master.
• I haven't run it against a real GitHub App installation.

Closes #3.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 771cf931-4776-4ffd-86c9-c37de58b6194

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}