Skip to content

Commit 22d11da

Browse files
stefaniukamaanibn-nasar1-nhs
stefaniuk
and
amaanibn-nasar1-nhs
authored
ENG-306,ENG-307: Acceptable use of GitHub PAT (Personal Access Token) and GitHub Apps for authentication and authorisation (nhs-england-tools#54)
- Fixes nhs-england-tools#33 - Fixes nhs-england-tools#34 --------- Co-authored-by: amaanibn-nasar1-nhs <[email protected]>
1 parent aee2543 commit 22d11da

File tree

15 files changed

+805
-0
lines changed

15 files changed

+805
-0
lines changed

‎docs/adr/ADR-003_Acceptable_use_of_GitHub_PAT_and_Apps_for_authN_and_authZ.md‎

Lines changed: 242 additions & 0 deletions
Large diffs are not rendered by default.

‎docs/adr/assets/ADR-003/examples/bash/README.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Example: Get GitHub App access token in Bash
2+
3+
Dependencies are `openssl`, `curl`, `jq` and `gh`.
4+
5+
Prepare environment:
6+
7+
```bash
8+
export GITHUB_APP_ID=...
9+
export GITHUB_APP_PK_FILE=...
10+
export GITHUB_ORG="nhs-england-tools"
11+
```
12+
13+
Run script:
14+
15+
```bash
16+
$ cd docs/adr/assets/ADR-003/examples/bash
17+
$ ./script.sh
18+
GITHUB_TOKEN=ghs_...
19+
```
20+
21+
Check the token:
22+
23+
```bash
24+
$ GITHUB_TOKEN=ghs_...; echo "$GITHUB_TOKEN" | gh auth login --with-token
25+
$ gh auth status
26+
github.com
27+
✓ Logged in to github.com as nhs-england-update-from-template[bot] (keyring)
28+
✓ Git operations for github.com configured to use https protocol.
29+
✓ Token: ghs_************************************
30+
```
31+
32+
See the [example (script.sh)](./script.sh) implementation. This script has been written to illustrate the concept in a clear and simple way. It is not a production ready code.

‎docs/adr/assets/ADR-003/examples/bash/script.sh‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
#!/bin/bash
2+
3+
function main() {
4+
5+
if [[ -z "$GITHUB_APP_ID" || -z "$GITHUB_APP_PK_FILE" || -z "$GITHUB_ORG" ]]; then
6+
echo "Environment variables GITHUB_APP_ID, GITHUB_APP_PK_FILE and GITHUB_ORG must be passed to this program."
7+
exit 1
8+
fi
9+
10+
jwt_token=$(get-jwt-token)
11+
installation_id=$(get-installation-id)
12+
access_token=$(get-access-token)
13+
14+
echo "GITHUB_TOKEN=$access_token"
15+
}
16+
17+
function get-jwt-token() {
18+
19+
header=$(echo -n '{"alg":"RS256","typ":"JWT"}' | base64 | tr -d '=' | tr -d '\n=' | tr -- '+/' '-_')
20+
payload=$(echo -n '{"iat":'$(date +%s)',"exp":'$(($(date +%s)+600))',"iss":"'$GITHUB_APP_ID'"}' | base64 | tr -d '\n=' | tr -- '+/' '-_')
21+
signature=$(echo -n "$header.$payload" | openssl dgst -binary -sha256 -sign "$GITHUB_APP_PK_FILE" | openssl base64 | tr -d '\n=' | tr -- '+/' '-_')
22+
23+
echo "$header.$payload.$signature"
24+
}
25+
26+
function get-installation-id() {
27+
28+
installations_response=$(curl -sX GET \
29+
-H "Authorization: Bearer $jwt_token" \
30+
-H "Accept: application/vnd.github.v3+json" \
31+
https://api.github.com/app/installations)
32+
33+
echo "$(echo $installations_response | jq '.[] | select(.account.login == "'"$GITHUB_ORG"'") .id')"
34+
}
35+
36+
function get-access-token() {
37+
38+
token_response=$(curl -sX POST \
39+
-H "Authorization: Bearer $jwt_token" \
40+
-H "Accept: application/vnd.github.v3+json" \
41+
https://api.github.com/app/installations/$installation_id/access_tokens)
42+
43+
echo "$(echo $token_response | jq .token -r)"
44+
}
45+
46+
main

‎docs/adr/assets/ADR-003/examples/golang/README.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Example: Get GitHub App access token in Golang
2+
3+
Dependencies are listed in the `go.mod` file.
4+
5+
Prepare environment:
6+
7+
```bash
8+
export GITHUB_APP_ID=...
9+
export GITHUB_APP_PK_FILE=...
10+
export GITHUB_ORG="nhs-england-tools"
11+
```
12+
13+
Run script:
14+
15+
```bash
16+
$ cd docs/adr/assets/ADR-003/examples/golang
17+
$ go run main.go
18+
GITHUB_TOKEN=ghs_...
19+
```
20+
21+
Check the token:
22+
23+
```bash
24+
$ GITHUB_TOKEN=ghs_...; echo "$GITHUB_TOKEN" | gh auth login --with-token
25+
$ gh auth status
26+
github.com
27+
✓ Logged in to github.com as nhs-england-update-from-template[bot] (keyring)
28+
✓ Git operations for github.com configured to use https protocol.
29+
✓ Token: ghs_************************************
30+
```
31+
32+
See the [example (main.go)](./main.go) implementation. This script has been written to illustrate the concept in a clear and simple way. It is not a production ready code.

‎docs/adr/assets/ADR-003/examples/golang/go.mod‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
module github-app-get-tokent
2+
3+
go 1.21.0
4+
5+
require (
6+
github.com/go-resty/resty/v2 v2.7.0 // indirect
7+
github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
8+
golang.org/x/net v0.0.0-20211029224645-99673261e6eb // indirect
9+
)

‎docs/adr/assets/ADR-003/examples/golang/go.sum‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
github.com/go-resty/resty/v2 v2.7.0 h1:me+K9p3uhSmXtrBZ4k9jcEAfJmuC8IivWHwaLZwPrFY=
2+
github.com/go-resty/resty/v2 v2.7.0/go.mod h1:9PWDzw47qPphMRFfhsyk0NnSgvluHcljSMVIq3w7q0I=
3+
github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
4+
github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
5+
golang.org/x/net v0.0.0-20211029224645-99673261e6eb h1:pirldcYWx7rx7kE5r+9WsOXPXK0+WH5+uZ7uPmJ44uM=
6+
golang.org/x/net v0.0.0-20211029224645-99673261e6eb/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
7+
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
8+
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
9+
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
10+
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
11+
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

‎docs/adr/assets/ADR-003/examples/golang/main.go‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
package main
2+
3+
import (
4+
"crypto/x509"
5+
"encoding/json"
6+
"encoding/pem"
7+
"fmt"
8+
"io/ioutil"
9+
"log"
10+
"os"
11+
"time"
12+
13+
"github.com/go-resty/resty/v2"
14+
"github.com/golang-jwt/jwt"
15+
)
16+
17+
type Installation struct {
18+
ID int `json:"id"`
19+
Account struct {
20+
Login string `json:"login"`
21+
} `json:"account"`
22+
}
23+
24+
func main() {
25+
26+
ghAppId := os.Getenv("GITHUB_APP_ID")
27+
ghAppPkFile := os.Getenv("GITHUB_APP_PK_FILE")
28+
ghOrg := os.Getenv("GITHUB_ORG")
29+
30+
if ghAppId == "" || ghAppPkFile == "" || ghOrg == "" {
31+
log.Fatalf("Environment variables GITHUB_APP_ID, GITHUB_APP_PK_FILE and GITHUB_ORG must be passed to this program.")
32+
}
33+
34+
jwtToken := getJwtToken(ghAppId, ghAppPkFile)
35+
installationId := getInstallationId(jwtToken, ghOrg)
36+
accessToken := getAccessToken(jwtToken, installationId)
37+
38+
fmt.Printf("GITHUB_TOKEN=%s\n", accessToken)
39+
}
40+
41+
func getJwtToken(ghAppId string, ghAppPkFile string) string {
42+
43+
pemContent, _ := ioutil.ReadFile(ghAppPkFile)
44+
block, _ := pem.Decode(pemContent)
45+
privateKey, _ := x509.ParsePKCS1PrivateKey(block.Bytes)
46+
token := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{
47+
"iat": time.Now().Unix(),
48+
"exp": time.Now().Add(10 * time.Minute).Unix(),
49+
"iss": ghAppId,
50+
})
51+
jwtToken, _ := token.SignedString(privateKey)
52+
53+
return jwtToken
54+
}
55+
56+
func getInstallationId(jwtToken string, ghOrg string) int {
57+
58+
client := resty.New()
59+
resp, _ := client.R().
60+
SetHeader("Authorization", "Bearer "+jwtToken).
61+
SetHeader("Accept", "application/vnd.github.v3+json").
62+
Get("https://api.github.com/app/installations")
63+
64+
var installations []Installation
65+
json.Unmarshal(resp.Body(), &installations)
66+
installationId := 0
67+
for _, installation := range installations {
68+
if installation.Account.Login == ghOrg {
69+
installationId = installation.ID
70+
}
71+
}
72+
73+
return installationId
74+
}
75+
76+
func getAccessToken(jwtToken string, installationId int) string {
77+
78+
client := resty.New()
79+
resp, _ := client.R().
80+
SetHeader("Authorization", "Bearer "+jwtToken).
81+
SetHeader("Accept", "application/vnd.github.v3+json").
82+
Post(fmt.Sprintf("https://api.github.com/app/installations/%d/access_tokens", installationId))
83+
84+
var result map[string]interface{}
85+
json.Unmarshal(resp.Body(), &result)
86+
87+
return result["token"].(string)
88+
}

‎docs/adr/assets/ADR-003/examples/nodejs/.gitignore‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
yarn.lock
2+
3+
SEE: https://github.com/github/gitignore/blob/main/Node.gitignore
4+
5+
# Logs
6+
logs
7+
*.log
8+
npm-debug.log*
9+
yarn-debug.log*
10+
yarn-error.log*
11+
lerna-debug.log*
12+
.pnpm-debug.log*
13+
14+
# Diagnostic reports (https://nodejs.org/api/report.html)
15+
report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
16+
17+
# Runtime data
18+
pids
19+
*.pid
20+
*.seed
21+
*.pid.lock
22+
23+
# Directory for instrumented libs generated by jscoverage/JSCover
24+
lib-cov
25+
26+
# Coverage directory used by tools like istanbul
27+
coverage
28+
*.lcov
29+
30+
# nyc test coverage
31+
.nyc_output
32+
33+
# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
34+
.grunt
35+
36+
# Bower dependency directory (https://bower.io/)
37+
bower_components
38+
39+
# node-waf configuration
40+
.lock-wscript
41+
42+
# Compiled binary addons (https://nodejs.org/api/addons.html)
43+
build/Release
44+
45+
# Dependency directories
46+
node_modules/
47+
jspm_packages/
48+
49+
# Snowpack dependency directory (https://snowpack.dev/)
50+
web_modules/
51+
52+
# TypeScript cache
53+
*.tsbuildinfo
54+
55+
# Optional npm cache directory
56+
.npm
57+
58+
# Optional eslint cache
59+
.eslintcache
60+
61+
# Optional stylelint cache
62+
.stylelintcache
63+
64+
# Microbundle cache
65+
.rpt2_cache/
66+
.rts2_cache_cjs/
67+
.rts2_cache_es/
68+
.rts2_cache_umd/
69+
70+
# Optional REPL history
71+
.node_repl_history
72+
73+
# Output of 'npm pack'
74+
*.tgz
75+
76+
# Yarn Integrity file
77+
.yarn-integrity
78+
79+
# dotenv environment variable files
80+
.env
81+
.env.development.local
82+
.env.test.local
83+
.env.production.local
84+
.env.local
85+
86+
# parcel-bundler cache (https://parceljs.org/)
87+
.cache
88+
.parcel-cache
89+
90+
# Next.js build output
91+
.next
92+
out
93+
94+
# Nuxt.js build / generate output
95+
.nuxt
96+
dist
97+
98+
# Gatsby files
99+
.cache/
100+
# Comment in the public line in if your project uses Gatsby and not Next.js
101+
# https://nextjs.org/blog/next-9-1#public-directory-support
102+
# public
103+
104+
# vuepress build output
105+
.vuepress/dist
106+
107+
# vuepress v2.x temp and cache directory
108+
.temp
109+
.cache
110+
111+
# Docusaurus cache and generated files
112+
.docusaurus
113+
114+
# Serverless directories
115+
.serverless/
116+
117+
# FuseBox cache
118+
.fusebox/
119+
120+
# DynamoDB Local files
121+
.dynamodb/
122+
123+
# TernJS port file
124+
.tern-port
125+
126+
# Stores VSCode versions used for testing VSCode extensions
127+
.vscode-test
128+
129+
# yarn v2
130+
.yarn/cache
131+
.yarn/unplugged
132+
.yarn/build-state.yml
133+
.yarn/install-state.gz
134+
.pnp.*

‎docs/adr/assets/ADR-003/examples/nodejs/README.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Example: Get GitHub App access token in Node.js TypeScript (using Octokit)
2+
3+
Dependencies are listed in the `package.json` file.
4+
5+
Prepare environment:
6+
7+
```bash
8+
export GITHUB_APP_ID=...
9+
export GITHUB_APP_PK_FILE=...
10+
export GITHUB_ORG="nhs-england-tools"
11+
```
12+
13+
Run script:
14+
15+
```bash
16+
$ cd docs/adr/assets/ADR-003/examples/nodejs
17+
$ yarn install
18+
$ yarn start
19+
[
20+
{
21+
name: 'repository-template',
22+
full_name: 'nhs-england-tools/repository-template',
23+
private: false,
24+
owner: {
25+
login: 'nhs-england-tools',
26+
...
27+
```
28+
29+
See the [example (main.ts)](./main.ts) implementation. This script has been written to illustrate the concept in a clear and simple way. It is not a production ready code.

0 commit comments

Comments
 (0)