diff --git a/docs/adr/ADR-003_Acceptable_use_of_GitHub_PAT_and_Apps_for_authN_and_authZ.md b/docs/adr/ADR-003_Acceptable_use_of_GitHub_PAT_and_Apps_for_authN_and_authZ.md index cd82a32..f8843af 100644 --- a/docs/adr/ADR-003_Acceptable_use_of_GitHub_PAT_and_Apps_for_authN_and_authZ.md +++ b/docs/adr/ADR-003_Acceptable_use_of_GitHub_PAT_and_Apps_for_authN_and_authZ.md @@ -1,12 +1,12 @@ # ADR-003: Acceptable use of GitHub authentication and authorisation mechanisms ->| | | ->| ------------ | --- | ->| Date | `04/09/2023` | ->| Status | `RFC` | ->| Deciders | `Engineering` | ->| Significance | `Construction techniques` | ->| Owners | `Amaan Ibn-Nasar, Jacob Gill, Dan Stefaniuk` | +> | | | +> | ------------ | -------------------------------------------- | +> | Date | `04/09/2023` | +> | Status | `RFC` | +> | Deciders | `Engineering` | +> | Significance | `Construction techniques` | +> | Owners | `Amaan Ibn-Nasar, Jacob Gill, Dan Stefaniuk` | --- @@ -225,7 +225,6 @@ graph LR ### Examples of acquiring access token - [Bash](./assets/ADR-003/examples/bash/README.md) -- [Golang](./assets/ADR-003/examples/golang/README.md) - [Node.js TypeScript (Octokit)](./assets/ADR-003/examples/nodejs/README.md) - This is our preferred method for implementing GitHub Apps. It is supported by the Octokit library, which is an official client for the GitHub API. - [Python](./assets/ADR-003/examples/python/README.md) diff --git a/docs/adr/assets/ADR-003/examples/golang/README.md b/docs/adr/assets/ADR-003/examples/golang/README.md deleted file mode 100644 index 87071af..0000000 --- a/docs/adr/assets/ADR-003/examples/golang/README.md +++ /dev/null @@ -1,32 +0,0 @@ -# Example: Get GitHub App access token in Golang - -Dependencies are listed in the `go.mod` file. - -Prepare environment: - -```bash -export GITHUB_APP_ID=... -export GITHUB_APP_PK_FILE=... -export GITHUB_ORG="nhs-england-tools" -``` - -Run script: - -```bash -$ cd docs/adr/assets/ADR-003/examples/golang -$ go run main.go -GITHUB_TOKEN=ghs_... -``` - -Check the token: - -```bash -$ GITHUB_TOKEN=ghs_...; echo "$GITHUB_TOKEN" | gh auth login --with-token -$ gh auth status -github.com - ✓ Logged in to github.com as nhs-england-update-from-template[bot] (keyring) - ✓ Git operations for github.com configured to use https protocol. - ✓ Token: ghs_************************************ -``` - -See the [example (main.go)](./main.go) implementation. This script has been written to illustrate the concept in a clear and simple way. It is not a production ready code. diff --git a/docs/adr/assets/ADR-003/examples/golang/go.mod b/docs/adr/assets/ADR-003/examples/golang/go.mod deleted file mode 100644 index 0cdf5e6..0000000 --- a/docs/adr/assets/ADR-003/examples/golang/go.mod +++ /dev/null @@ -1,10 +0,0 @@ -module github-app-get-tokent - -go 1.21.0 - -require ( - github.com/go-resty/resty/v2 v2.7.0 - github.com/golang-jwt/jwt v3.2.2+incompatible -) - -require golang.org/x/net v0.23.0 // indirect diff --git a/docs/adr/assets/ADR-003/examples/golang/go.sum b/docs/adr/assets/ADR-003/examples/golang/go.sum deleted file mode 100644 index 646b27e..0000000 --- a/docs/adr/assets/ADR-003/examples/golang/go.sum +++ /dev/null @@ -1,12 +0,0 @@ -github.com/go-resty/resty/v2 v2.7.0 h1:me+K9p3uhSmXtrBZ4k9jcEAfJmuC8IivWHwaLZwPrFY= -github.com/go-resty/resty/v2 v2.7.0/go.mod h1:9PWDzw47qPphMRFfhsyk0NnSgvluHcljSMVIq3w7q0I= -github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY= -github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I= -golang.org/x/net v0.0.0-20211029224645-99673261e6eb/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs= -golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg= -golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= diff --git a/docs/adr/assets/ADR-003/examples/golang/main.go b/docs/adr/assets/ADR-003/examples/golang/main.go deleted file mode 100644 index 42553cf..0000000 --- a/docs/adr/assets/ADR-003/examples/golang/main.go +++ /dev/null @@ -1,88 +0,0 @@ -package main - -import ( - "crypto/x509" - "encoding/json" - "encoding/pem" - "fmt" - "io/ioutil" - "log" - "os" - "time" - - "github.com/go-resty/resty/v2" - "github.com/golang-jwt/jwt" -) - -type Installation struct { - ID int `json:"id"` - Account struct { - Login string `json:"login"` - } `json:"account"` -} - -func main() { - - ghAppId := os.Getenv("GITHUB_APP_ID") - ghAppPkFile := os.Getenv("GITHUB_APP_PK_FILE") - ghOrg := os.Getenv("GITHUB_ORG") - - if ghAppId == "" || ghAppPkFile == "" || ghOrg == "" { - log.Fatalf("Environment variables GITHUB_APP_ID, GITHUB_APP_PK_FILE and GITHUB_ORG must be passed to this program.") - } - - jwtToken := getJwtToken(ghAppId, ghAppPkFile) - installationId := getInstallationId(jwtToken, ghOrg) - accessToken := getAccessToken(jwtToken, installationId) - - fmt.Printf("GITHUB_TOKEN=%s\n", accessToken) -} - -func getJwtToken(ghAppId string, ghAppPkFile string) string { - - pemContent, _ := ioutil.ReadFile(ghAppPkFile) - block, _ := pem.Decode(pemContent) - privateKey, _ := x509.ParsePKCS1PrivateKey(block.Bytes) - token := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{ - "iat": time.Now().Unix(), - "exp": time.Now().Add(10 * time.Minute).Unix(), - "iss": ghAppId, - }) - jwtToken, _ := token.SignedString(privateKey) - - return jwtToken -} - -func getInstallationId(jwtToken string, ghOrg string) int { - - client := resty.New() - resp, _ := client.R(). - SetHeader("Authorization", "Bearer "+jwtToken). - SetHeader("Accept", "application/vnd.github.v3+json"). - Get("https://api.github.com/app/installations") - - var installations []Installation - json.Unmarshal(resp.Body(), &installations) - installationId := 0 - for _, installation := range installations { - if installation.Account.Login == ghOrg { - installationId = installation.ID - } - } - - return installationId -} - -func getAccessToken(jwtToken string, installationId int) string { - - client := resty.New() - resp, _ := client.R(). - SetHeader("Authorization", "Bearer "+jwtToken). - SetHeader("Accept", "application/vnd.github.v3+json"). - Post(fmt.Sprintf("https://api.github.com/app/installations/%d/access_tokens", installationId)) - - var result map[string]interface{} - json.Unmarshal(resp.Body(), &result) - - return result["token"].(string) -}