How can I authenticate as an App?

[justinmchase]

I have an app and I've created a private key:

How can I use this private key to authenticate and use the cli?

[mislav]

No, GitHub CLI only accepts access tokens as means of authentication. You can use your App to generate an access token on behalf of a user, but you will have to do so manually, as GitHub CLI can't help with that. #5095 (comment)

Alternatively, if you use gh auth login to authenticate GitHub CLI, it will use our own OAuth app for that. However, that will completely side-step your own App.

[justinmchase]

Also the fact that I can use the private key to cut a JWT and use that to call some API's is interesting, seems like something the cli could handle.

[mislav]

Thanks for sharing! What would be the use-case for having this in the CLI?

GitHub CLI by default authenticates over its OAuth app (which are the types of apps that predate GitHub Apps), so having built-in functionality to also authenticate Apps could be confusing for the user.

[justinmchase]

Sure and I don't see why it wouldn't continue to do so but on the other hand its also confusing to users to have gh auth not auth sometimes and to in fact have no way to auth at all as an app. Thats super confusing.

[justinmchase]

@mislav See the other answers below including this gh plugin: https://github.com/Link-/gh-token

There is clearly a need and while this plugin works, it seems like it should be built in to the auth.

My use case was essentially running in Jenkins, inside of a check-run event, I am doing somethings using the GH api such as opening Releases and some PR comments, etc. From within Jenkins using the gh cli is the easiest way to interact with the api and its easiest for me to auth with an APP as a non-user and control access to it via app installation. Therefore I just need to create an installation token and utilize that when interacting with the gh cli.

[patricioperezv]

What about using withCredentials with the username password binding and the Jenkins github plugin? In the password field you are going to get a token and gh cli can leverage the GITHUB_TOKEN env variable to do it's thing.

Something like
withCredentials([usernamePassword(credentialsId: "my-github-app", passwordVariable: "GITHUB_TOKEN", usernameVariable: "GITHUB_APPID")]) { sh "gh pr list -R MyOrg/myRepo" }

[dobesv]

Here's an example of how to generate a GITHUB_TOKEN in bash:

# If we have GitHub App credentials, this will set GITHUB_TOKEN and run gh auth setup-git which will make it
# so that git fetch, pull, and push will use it via the gh cli if the remote URL is https://github.com/
# GITHUB_APP_SECRET_PATH must be the path to the github app secret with the .pem file extension
# Dependencies:
#
# - [jwt-cli](https://github.com/mike-engel/jwt-cli)
# - [yq v3](https://github.com/mikefarah/yq/tree/v3.x)
# - curl
# - [gh](https://cli.github.com/)
#
# You can probably adjust this to use `jq` or the latest version of `yq` without too much trouble.

setup-gh-app-auth() {
  if [[ "${GITHUB_APP_ID}" != "" ]] && [[ -e "${GITHUB_APP_SECRET_PATH}" ]] ; then
    # Create a temporary JWT for API access
    GITHUB_JWT=$( jwt encode --secret "@${GITHUB_APP_SECRET_PATH}" -i "${GITHUB_APP_ID}" -e "10 minutes" --alg RS256 )
    # Request installation information; note that this assumes there's just one installation (this is a private GitHub app);
    # if you have multiple installations you'll have to customize this to pick out the installation you are interested in    
    APP_TOKEN_URL=$( curl -s -H "Authorization: Bearer ${GITHUB_JWT}" -H "Accept: application/vnd.github.v3+json" https://api.github.com/app/installations | yq r - '[0].access_tokens_url' )
    # Now POST to the installation token URL to generate a new access token we can use to with with the gh and hub command lines
    export GITHUB_TOKEN=$( curl -s -X POST -H "Authorization: Bearer ${GITHUB_JWT}" -H "Accept: application/vnd.github.v3+json" ${APP_TOKEN_URL} | yq r - token )
    # Configure gh as an auth provider for git so we can use git push / pull / fetch with github.com URLs
    gh auth setup-git
  fi
}

[justinmchase]

PRO answer!

So gh auth setup-git essentially finds the token because it is in the GITHUB_TOKEN env var?

[ajschmidt8]

For anyone having issues with the jwt snippet, see the issue below:

• encode always errors with "Invalid JSON provided!" on 6.0.0 mike-engel/jwt-cli#290

I got it working after I changed -e "10 minutes" flag to -e="10 minutes" (note the = sign).

[dobesv]

See also https://github.com/Link-/gh-token

[markcheret]

@dobesv thanks for your contribution. It got me kickstarted with authenticating against github. I made slight modifications to make it work
@justinmchase FYI

the code around the yq commands is especially interesting: (I'm using the latest version of yq)
yq r - '[0].access_tokens_url' -> yq -r '.[0].access_tokens_url'
yq r - token -> yq -r '.token'

setup-gh-app-auth() {
  if [[ "${GITHUB_APP_ID}" != "" ]] && [[ -e "${GITHUB_APP_SECRET_PATH}" ]] ; then
    # Create a temporary JWT for API access
    GITHUB_JWT=$( jwt encode --secret "@${GITHUB_APP_SECRET_PATH}" -i "${GITHUB_APP_ID}" -e "10 minutes" --alg RS256 )
    # Request installation information; note that this assumes there's just one installation (this is a private GitHub app);
    # if you have multiple installations you'll have to customize this to pick out the installation you are interested in    
    APP_TOKEN_URL=$( curl -s -H "Authorization: Bearer ${GITHUB_JWT}" -H "Accept: application/vnd.github.v3+json" https://api.github.com/app/installations | yq -r '.[0].access_tokens_url' )
    # Now POST to the installation token URL to generate a new access token we can use to with with the gh and hub command lines
    export GITHUB_TOKEN=$( curl -s -X POST -H "Authorization: Bearer ${GITHUB_JWT}" -H "Accept: application/vnd.github.v3+json" ${APP_TOKEN_URL} | yq -r '.token' )
    # Configure gh as an auth provider for git so we can use git push / pull / fetch with github.com URLs
    gh auth setup-git
  fi
}

[justinmchase]

Dauuum, that is pretty condensed, gj.

[ajschmidt8]

For anyone having issues with the jwt snippet, see the issue below:

• encode always errors with "Invalid JSON provided!" on 6.0.0 mike-engel/jwt-cli#290

I got it working after I changed -e "10 minutes" flag to -e="10 minutes" (note the = sign).