1- """This is the module that contains functions related to authenticating to GitHub with a personal access token."""
1+ """GitHub authentication module for the InnerSource measurement tool.
2+
3+ This module provides functions for authenticating with GitHub using either Personal Access
4+ Tokens (PAT) or GitHub App installations. It supports both GitHub.com and GitHub Enterprise
5+ Server installations.
6+
7+ Authentication Methods:
8+ 1. Personal Access Token (PAT) - Simple token-based authentication
9+ 2. GitHub App Installation - More secure app-based authentication with JWT
10+
11+ The module handles the complexity of different authentication methods and provides
12+ a unified interface for establishing authenticated connections to GitHub's API.
13+
14+ Functions:
15+ auth_to_github: Create an authenticated GitHub client connection
16+ get_github_app_installation_token: Obtain installation tokens for GitHub Apps
17+
18+ Dependencies:
19+ - github3.py: GitHub API client library
20+ - requests: HTTP library for API calls
21+ """
222
323import github3
424import requests
@@ -13,19 +33,52 @@ def auth_to_github(
1333 gh_app_enterprise_only : bool ,
1434) -> github3 .GitHub :
1535 """
16- Connect to GitHub.com or GitHub Enterprise, depending on env variables.
17-
36+ Establish an authenticated connection to GitHub.com or GitHub Enterprise.
37+
38+ This function creates an authenticated GitHub client using either Personal Access Token
39+ or GitHub App authentication. It supports both GitHub.com and GitHub Enterprise
40+ installations.
41+
42+ Authentication Priority:
43+ 1. GitHub App authentication (if all app credentials are provided)
44+ 2. Personal Access Token authentication (if token is provided)
45+
1846 Args:
19- token (str): the GitHub personal access token
20- gh_app_id (int | None): the GitHub App ID
21- gh_app_installation_id (int | None): the GitHub App Installation ID
22- gh_app_private_key_bytes (bytes): the GitHub App Private Key
23- ghe (str): the GitHub Enterprise URL
24- gh_app_enterprise_only (bool): Set this to true if the GH APP is created
25- on GHE and needs to communicate with GHE api only
47+ token (str): The GitHub personal access token for authentication.
48+ Can be empty if using GitHub App authentication.
49+ gh_app_id (int | None): The GitHub App ID for app-based authentication.
50+ Required along with other app credentials for app auth.
51+ gh_app_installation_id (int | None): The GitHub App Installation ID.
52+ Required for app-based authentication.
53+ gh_app_private_key_bytes (bytes): The GitHub App Private Key as bytes.
54+ Required for app-based authentication.
55+ ghe (str): The GitHub Enterprise URL (e.g., "https://github.company.com").
56+ Leave empty for GitHub.com.
57+ gh_app_enterprise_only (bool): Set to True if the GitHub App is created
58+ on GitHub Enterprise and should only communicate
59+ with the GHE API endpoint.
2660
2761 Returns:
28- github3.GitHub: the GitHub connection object
62+ github3.GitHub: An authenticated GitHub client object that can be used
63+ to make API calls to GitHub.
64+
65+ Raises:
66+ ValueError: If authentication fails due to:
67+ - Missing required credentials (no token or incomplete app credentials)
68+ - Unable to establish connection to GitHub
69+
70+ Examples:
71+ >>> # Using Personal Access Token
72+ >>> client = auth_to_github(token="ghp_...", gh_app_id=None,
73+ ... gh_app_installation_id=None,
74+ ... gh_app_private_key_bytes=b"",
75+ ... ghe="", gh_app_enterprise_only=False)
76+
77+ >>> # Using GitHub App
78+ >>> client = auth_to_github(token="", gh_app_id=12345,
79+ ... gh_app_installation_id=67890,
80+ ... gh_app_private_key_bytes=private_key_bytes,
81+ ... ghe="", gh_app_enterprise_only=False)
2982 """
3083 if gh_app_id and gh_app_private_key_bytes and gh_app_installation_id :
3184 if ghe and gh_app_enterprise_only :
@@ -58,17 +111,47 @@ def get_github_app_installation_token(
58111 gh_app_installation_id : str ,
59112) -> str | None :
60113 """
61- Get a GitHub App Installation token.
62- API: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-as-a-github-app-installation # noqa: E501
63-
114+ Obtain a GitHub App Installation access token using JWT authentication.
115+
116+ This function creates a JWT token using the GitHub App's private key and exchanges
117+ it for an installation access token that can be used to authenticate API requests
118+ on behalf of the installed app.
119+
120+ Reference: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-as-a-github-app-installation
121+
64122 Args:
65- ghe (str): the GitHub Enterprise endpoint
66- gh_app_id (str): the GitHub App ID
67- gh_app_private_key_bytes (bytes): the GitHub App Private Key
68- gh_app_installation_id (str): the GitHub App Installation ID
123+ ghe (str): The GitHub Enterprise endpoint URL (e.g., "https://github.company.com").
124+ Leave empty for GitHub.com.
125+ gh_app_id (str): The GitHub App ID as a string.
126+ gh_app_private_key_bytes (bytes): The GitHub App Private Key in bytes format.
127+ This should be the complete private key including
128+ the header and footer.
129+ gh_app_installation_id (str): The GitHub App Installation ID as a string.
130+ This identifies the specific installation of the app.
69131
70132 Returns:
71- str: the GitHub App token
133+ str | None: The installation access token if successful, None if the request
134+ fails or if there's an error in the authentication process.
135+
136+ Raises:
137+ No exceptions are raised directly, but request failures are handled gracefully
138+ and logged to the console.
139+
140+ Notes:
141+ - The token has a default expiration time (typically 1 hour)
142+ - The token provides access to resources the app installation has been granted
143+ - Network errors and API failures are handled gracefully with None return
144+
145+ Examples:
146+ >>> private_key = b"-----BEGIN PRIVATE KEY-----\\ n...\\ n-----END PRIVATE KEY-----"
147+ >>> token = get_github_app_installation_token(
148+ ... ghe="",
149+ ... gh_app_id="12345",
150+ ... gh_app_private_key_bytes=private_key,
151+ ... gh_app_installation_id="67890"
152+ ... )
153+ >>> if token:
154+ ... print("Successfully obtained installation token")
72155 """
73156 jwt_headers = github3 .apps .create_jwt_headers (gh_app_private_key_bytes , gh_app_id )
74157 api_endpoint = f"{ ghe } /api/v3" if ghe else "https://api.github.com"
0 commit comments