Expose a readonly App Github Token to Runs

I have a bunch of terraform modules that are normally loaded via git. Currently they are referenced as ssh urls, but in automation we just add a git insteadOf rule which on the fly rewrites them from ssh to http urls, and this is also a great place we usually inject a github token in automation to allow reading from those other repos. Those other repos are within our github org, so the Spacelift App has access to them. If spacelift could just expose (optionally, perhaps as an Integration you enable in a run/Environment) the github token .. we could have an init hook make the necessary adjustments to the git config to make it all work nicely.

This normally would be just calling both of these

git config --global url.https://oauth2:${token}@github.com.insteadOf ssh://git@github.com
git config --global url.https://oauth2:${token}@github.com/.insteadOf ssh://git@github.com:

(yes there is a subtle difference with the colon/slash in there .. and it seems to be needed :))

I mean sure you could also do the above as part of setting up the GitHub integration in the run :)

Workaround
There isn't really .. this is blocking us from transitioning to Spacelift .. We may go to the PAT route just to make things easier, but its not ideal .. long lived credentials like that suck :) https://docs.spacelift.io/vendors/terraform/external-modules.html#using-https
Problem
-

Please authenticate to join the conversation.

Upvoters
Status

⬆️ Gathering votes

Board

💡 Feature Requests

Tags

VCS

Date

Over 1 year ago

Subscribe to post

Get notified by email when there are changes.