[WIP] feat(github): GitHub App authentication by cbartz · Pull Request #774 · canonical/github-runner-operator

cbartz · 2026-03-30T13:51:44Z

Applicable spec:

Overview

Add GitHub App authentication

Rationale

Juju Events Changes

Module Changes

Library Changes

Checklist

The charm style guide was applied.
The contributing guide was applied.
The changes are compliant with ISD054 - Managing Charm Complexity
The documentation for charmhub is updated.
The PR is tagged with appropriate label (urgent, trivial, complex).
The changelog is updated with changes that affects the users of the charm.
The application version number is updated in github-runner-manager/pyproject.toml.

Copilot

Pull request overview

Adds GitHub App–based authentication (in addition to PATs) to the charm and the embedded github-runner-manager, including Juju secret handling for the App private key and corresponding docs/tests.

Changes:

Introduces GitHubTokenAuth / GitHubAppAuth models and migrates GitHubConfiguration from token to auth.
Extends charm config/state translation to validate mutually exclusive PAT vs App auth and fetch the App private key from a Juju secret.
Updates unit/integration tests, documentation, changelog, and CI to cover GitHub App auth.

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/unit/test_factories.py	Updates factory tests to use `GitHubConfiguration(auth=...)` and adds coverage for selecting auth model.
tests/unit/test_charm_state.py	Adds unit tests for PAT-only, App-only, partial App config, and invalid combinations.
tests/unit/test_charm.py	Expands config-changed flush/no-flush tests to include new GitHub App config options.
tests/unit/factories.py	Adds default values for new GitHub App config options in test factories.
tests/unit/conftest.py	Extends the `complete_charm_state` fixture with new auth-related fields.
src/factories.py	Plumbs auth selection into application configuration creation (`GitHubConfiguration.auth`).
src/charm_state.py	Implements PAT/App auth validation and secret lookup for the GitHub App private key; exposes `GithubConfig.auth`.
src/charm.py	Tracks new GitHub App config values in stored state and triggers flush on changes.
github-runner-manager/tox.ini	Allows passing GitHub App credential env vars into tox integration runs.
github-runner-manager/tests/unit/test_github_client.py	Updates client tests for new constructor and validates PyGithub auth initialization calls.
github-runner-manager/tests/unit/test_config.py	Updates config YAML shape and adds validation tests for auth models.
github-runner-manager/tests/unit/platform/test_github_provider.py	Ensures platform build uses `GitHubConfiguration.auth` to construct `GithubClient`.
github-runner-manager/tests/unit/platform/test_factory.py	Updates platform factory test to use `GitHubConfiguration(auth=...)`.
github-runner-manager/tests/integration/test_github_app_auth.py	Adds integration test exercising JIT token retrieval via GitHub App auth.
github-runner-manager/tests/integration/factories.py	Updates integration config factory to emit `github_config.auth.token` structure.
github-runner-manager/tests/conftest.py	Adds pytest CLI options/env defaults for GitHub App integration credentials.
github-runner-manager/src/github_runner_manager/platform/github_provider.py	Switches platform build to pass `github_configuration.auth` into `GithubClient`.
github-runner-manager/src/github_runner_manager/github_client.py	Refactors `GithubClient` to accept `GitHubAuth` and build PyGithub auth accordingly.
github-runner-manager/src/github_runner_manager/configuration/github.py	Adds auth model types and replaces `GitHubConfiguration.token` with `auth`.
github-runner-manager/src/github_runner_manager/configuration/init.py	Exports new GitHub auth models/types from the configuration package.
github-runner-manager/pyproject.toml	Bumps `github-runner-manager` version to `0.18.0`.
docs/reference/token-scopes.md	Documents GitHub App authentication and required permissions alongside PAT scopes.
docs/reference/charm-architecture.md	Updates architecture docs to reflect PAT or GitHub App credentials.
docs/how-to/change-token.md	Updates how-to to cover switching/rotating GitHub App auth as well as PATs.
docs/explanation/security.md	Updates security guidance to prefer GitHub App auth and Juju secret storage.
docs/changelog.md	Adds a user-facing changelog entry for GitHub App auth support.
charmcraft.yaml	Adds new charm config options for GitHub App auth and tidies whitespace.
.github/workflows/test_github_runner_manager.yaml	Adds the new GitHub App auth integration test module to the workflow matrix and passes additional secrets.

tests/unit/test_charm.py

github-runner-manager/src/github_runner_manager/github_client.py

Copilot

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated 2 comments.

src/charm_state.py

src/factories.py

# Conflicts: # github-runner-manager/pyproject.toml # src/manager_service.py

Copilot

Pull request overview

Copilot reviewed 30 out of 30 changed files in this pull request and generated 7 comments.

src/charm_state.py

docs/reference/token-scopes.md

src/charm_state.py

docs/reference/token-scopes.md

Copilot

Pull request overview

Copilot reviewed 30 out of 30 changed files in this pull request and generated 4 comments.

Copilot · 2026-03-31T09:27:33Z

src/manager_service.py

    unit_dir.mkdir(parents=True, exist_ok=True)
    path = unit_dir / "config.yaml"
-    with open(path, "w+", encoding="utf-8") as file:
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)


os.open(..., 0o600) only applies the 0600 mode when the file is created; if config.yaml already exists (e.g., from a previous revision) with broader permissions, this will truncate it but keep the old mode, potentially leaving GitHub credentials readable by other users. Consider explicitly enforcing permissions after opening/writing (e.g., os.fchmod(fd, 0o600) or path.chmod(0o600)) so the file is always 0600.

Suggested change

fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)

fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)

os.fchmod(fd, 0o600)

Copilot · 2026-03-31T09:27:34Z

docs/how-to/change-token.md

-## Changing the token
+## GitHub app authentication
+
+Create a [GitHub App](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app) with the required permissions and install it on the target organisation or repository.


US English spelling: “organisation” should be “organization”.

Suggested change

Create a [GitHub App](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app) with the required permissions and install it on the target organisation or repository.

Create a [GitHub App](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app) with the required permissions and install it on the target organization or repository.

Copilot · 2026-03-31T09:27:34Z

docs/explanation/security.md

 This approach ensures that all code from external contributors is reviewed by trusted users before execution on self-hosted runners.

-## Permission for GitHub app or personal access token
+## Permissions for GitHub app or personal access token


Capitalize the GitHub product name consistently: “GitHub app” should be “GitHub App”.

Suggested change

## Permissions for GitHub app or personal access token

## Permissions for GitHub App or personal access token

Copilot · 2026-03-31T09:27:34Z

docs/reference/token-scopes.md

+[personal access token (PAT)](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens).

-## Fine grained access token scopes
+## GitHub app authentication


Capitalize the GitHub product name consistently in headings: “GitHub app authentication” should be “GitHub App authentication”.

Suggested change

## GitHub app authentication

## GitHub App authentication

cbartz added 7 commits March 30, 2026 15:44

feat: add github app auth

7b5a36c

test(github): add app integration test to test app authentication

6db2395

fix(github): rename app id to app client id

92f4f0c

docs(github): update docs with github app auth

959eb25

chore(test): add clarifying comment about GitHub App env vars

a5bc4d6

docs(changelog): update date

63496e8

chore(version): bump minor version

cb73567

github-actions bot added the Libraries: OK label Mar 30, 2026

cbartz added 3 commits March 30, 2026 16:07

fix(test): use assert runner.identity.instance_id == instance_id

ef01c33

chore(charm_state): remove unused code

fa29e04

fix(test): fix github config factory

a2e864d

cbartz requested a review from Copilot March 30, 2026 16:08

Copilot started reviewing on behalf of cbartz March 30, 2026 16:09 View session

Copilot AI reviewed Mar 30, 2026

View reviewed changes

tests/unit/test_charm.py Outdated Show resolved Hide resolved

github-runner-manager/src/github_runner_manager/github_client.py Show resolved Hide resolved

github-runner-manager/src/github_runner_manager/github_client.py Outdated Show resolved Hide resolved

cbartz added 4 commits March 30, 2026 21:43

chore(test): remove unused fixture

cda33c8

fix(docs): minor typos

4c5d271

fix(lint): remove empty line

5ed9561

fix(docs): fix vale violations

98816aa

cbartz requested a review from Copilot March 30, 2026 20:48

Copilot started reviewing on behalf of cbartz March 30, 2026 20:50 View session

Copilot AI reviewed Mar 30, 2026

View reviewed changes

src/charm_state.py Show resolved Hide resolved

src/factories.py Outdated Show resolved Hide resolved

cbartz added 4 commits March 31, 2026 08:07

fix(error): fix err msg

efb6cb3

fix(security): change permissions to 0600 for config file

86a7d1f

Merge branch 'main' into feat/github-app-auth

00b23ca

# Conflicts: # github-runner-manager/pyproject.toml # src/manager_service.py

chore(changelog): update changelog

4818b86

cbartz requested a review from Copilot March 31, 2026 06:29

Copilot started reviewing on behalf of cbartz March 31, 2026 06:30 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

cbartz added 2 commits March 31, 2026 10:46

chore(charm_state): remove reundant code

1c63d57

docs(token): use american english

4823017

refactor: simplify auth wiring between CharmConfig and factories

6fc6eaa

cbartz requested a review from Copilot March 31, 2026 09:21

Copilot started reviewing on behalf of cbartz March 31, 2026 09:22 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

	fd = os.open(path, os.O_WRONLY \| os.O_CREAT \| os.O_TRUNC, 0o600)
	fd = os.open(path, os.O_WRONLY \| os.O_CREAT \| os.O_TRUNC, 0o600)
	os.fchmod(fd, 0o600)

	Create a [GitHub App](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app) with the required permissions and install it on the target organisation or repository.
	Create a [GitHub App](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app) with the required permissions and install it on the target organization or repository.

	## Permissions for GitHub app or personal access token
	## Permissions for GitHub App or personal access token

Conversation

cbartz commented Mar 30, 2026

Overview

Rationale

Juju Events Changes

Module Changes

Library Changes

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants