A personal access token in a source control credential is a long lived secret that belongs to a person, usually with more reach than the one repository it was made for, and it keeps working after that person has moved on. A GitHub App is the way out of that: it is installed on the repositories you choose with the permissions you choose, and it hands out installation tokens that expire on their own. Ascender holds the app and mints a token per job, so no token is stored anywhere and none has to be rotated by hand.
The lookup credential
The credential type is GitHub App Installation Access Token Lookup. It is an external credential, in the same family as the HashiCorp Vault and Azure Key Vault lookups: it stores no token, it fetches one when a job needs it.
- GitHub API endpoint URL:
https://api.github.com by default, or your Enterprise API, self hosted or cloud.
- GitHub App ID or Client ID: from the app's own page in your account or organization settings.
- GitHub App Installation ID: the number at the end of the installation link.
- RSA private key: the contents of the PEM the app generated.
Attach it to a field of another credential the way any lookup is attached, and every job using that credential gets a token minted for the run instead of a secret that has sat in the database since someone pasted it there.
Source control URLs
Tokens from an app are used with x-access-token as the username, and the URL validation used to insist the username be exactly git on GitHub hosts, so the credential worked everywhere except the place most people wanted it. Both git and x-access-token are accepted now, and the check matches hosts under github.com rather than that one literal hostname. Bitbucket keeps the old rule, since none of this applies there.
The private key does not have to live in Ascender
A follow up made the RSA key itself sourceable from another external credential, so the PEM can stay in Azure Key Vault, or wherever your secrets live, and the GitHub App credential holds a pointer to it rather than the key. That meant allowing an external credential to be the target of an input source, which was refused outright, so the blanket rule gave way to a self link check and cycle detection: a credential cannot source from itself, and a chain of them cannot close into a loop, which is checked before the link is saved.
Credit
The credential is Klaas-'s in #239, adapted from the Apache 2.0 licensed github_app plugin in ansible/awx-plugins, with the key sourcing follow up in #240. The source control URL fix is keepittechie's in #485.
If you are running this against GitHub Enterprise, say so in a reply. The endpoint field takes both the self hosted and the cloud shape, and it would be worth having a confirmed example of each in one place.
