Git clone from private github repository with Github Actions token

user_2803066 0
Viewed 1790

I need to do some directory grooming before my app is ready to be tested or deployed. I would like to utilize a Makefile target which calls a shell script in the repo to make this CI/CD-agnostic. One can call this target with make prepare_directory

The CI platform I am using is Github Actions. Here are the relevant parts of the workflow which is being run on new Pull Requests:

name: PR Tests
env:
  GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 1
      - name: Prep directoy
        run: make prepare_directory

Here is the relevant part of the Makefile (which works exactly as expected locally):

...
prepare_directory:
    ./scripts/prepare_directory.sh

clean:
    @rm -Rf ./$(BUILDPREFIX)

.PHONY: all clean docker lint prep_avro $(dockerbuilds)

Here is the relevant part of the ./scripts/prepare-directory.sh script:

#!/bin/bash -e
# ...
# clone repo using https and GITHUB_TOKEN
git clone https://$GIT_TOKEN@github.com:USERNAME/REPO.git

When I try to clone using that URL, from the shell script, the script fails (along with the Github workflow pipeline) with the following error: fatal: unable to access 'https://github.com:USERNAME/REPO.git/': URL using bad/illegal format or missing URL

Does anybody know what I'm doing wrong?

github-actions git-clone
2 Answers

You can add this action after your checkout step and GitHub can access your private repo dependancy.

Note:- Make sure to add a server's private key as a secret, public key to GitHub SSH keys and Please replace your private repo URL from https+auth_token to SSH. ssh://git@github.com/your_group/your_project.git

Below is the example

      - uses: webfactory/ssh-agent@v0.4.1
        with:
          ssh-private-key: ${{ secrets.SSH_KEY }}

SSH_KEY is the private key secret which you created.

user_164144250

I've created a GitHub App and Github Action to workaround these limitations GitHub Actions Access Manager. Feel free to drop some feedback.

Workflow

enter image description here

  1. This GitHub action will request an access token for a Target Repository from the App Server, authorize by the GitHub Action ID Token (JWT signed by GitHub).
  2. The App Server requests a GitHub App Installation Token to read .github/access.yaml file in Target Repository.
  3. The App Server reads .github/access.yaml file from Target Repository and determine which permissions should be granted to Requesting Repository, authorized by the GitHub App Installation Token from step 2..
  4. The App Server requests a GitHub App Installation Token with granted permissions for Source Directory and send it back in response to the GitHub action from step 1..
  5. The GitHub action sets the token as environment variable $GITHUB_ACCESS_TOKEN and as step output value ${{ steps.github-actions-access.outputs.token }}.
  6. Further steps can then utilize this token to access resources of the Target Repository.
user_53766350
Related