🚀[Feature] Support GitHub Installation tokens

[Manbearpiet]

GitHub Apps

We use GitHub Apps to automate actions on the GitHub platform. By creating a JWT, we authenticate to GitHub and request an installation token that functions the same as a PAT for that specific organization that installed the GitHub App.

When we use it for authentication we run into the following errors:

connect-gitHubAccount -AccessToken -Silent -Owner WeAreInSpark
! Enter your personal access token: ****************************************
Write-Warning: A parameter cannot be found that matches parameter name 'ForegroundColor'.
WARNING: Unexpected access token format: ghs_*
Invoke-GitHubAPI:
Invoke-GitHubAPI: ----------------------------------
Invoke-GitHubAPI:
Invoke-GitHubAPI: Request:
Invoke-GitHubAPI:
Invoke-GitHubAPI: StatusCodeVariable      : APICallStatusCode
Invoke-GitHubAPI: Method                  : 1
Invoke-GitHubAPI: ContentType             : application/vnd.github+json; charset=utf-8
Invoke-GitHubAPI: Authentication          : Bearer
Invoke-GitHubAPI: FollowRelLink           : True
Invoke-GitHubAPI: HttpVersion             : @{Major=2; Minor=0; Build=-1; Revision=-1; MajorRevision=-1; MinorRevision=-1}
Invoke-GitHubAPI: ResponseHeadersVariable : APICallResponseHeaders
Invoke-GitHubAPI: Token                   : @{Length=40}
Invoke-GitHubAPI: Uri                     : https://api.github.com/user
Invoke-GitHubAPI: Headers                 : @{Accept=application/vnd.github+json; charset=utf-8; X-GitHub-Api-Version=2022-11-28}
Invoke-GitHubAPI:
Invoke-GitHubAPI:
Invoke-GitHubAPI: ----------------------------------
Invoke-GitHubAPI:
Invoke-GitHubAPI: Message:
Invoke-GitHubAPI: Response status code does not indicate success: 403 (Forbidden).
Invoke-GitHubAPI:
Invoke-GitHubAPI: ----------------------------------
Invoke-GitHubAPI:
Invoke-GitHubAPI: Response:
Invoke-GitHubAPI:
Invoke-GitHubAPI: Version             : @{Major=2; Minor=0; Build=-1; Revision=-1; MajorRevision=-1; MinorRevision=-1}
Invoke-GitHubAPI: Content             : @{Headers=System.Object[]}
Invoke-GitHubAPI: StatusCode          : 403
Invoke-GitHubAPI: ReasonPhrase        : Forbidden
Invoke-GitHubAPI: Headers             : {@{Key=Server; Value=System.Object[]}, @{Key=Date; Value=System.Object[]}, @{Key=x-github-media-type;
Value=System.Object[]}, @{Key=x-github-api-version-selected; Value=System.Object[]}…}
Invoke-GitHubAPI: TrailingHeaders     : {}
Invoke-GitHubAPI: RequestMessage      : @{Version=; VersionPolicy=0; Content=; Method=; RequestUri=https://api.github.com/user; Headers=System.Object[];
Properties=System.Object[]; Options=System.Object[]}
Invoke-GitHubAPI: IsSuccessStatusCode : False
Invoke-GitHubAPI:
Invoke-GitHubAPI:
Invoke-GitHubAPI: ----------------------------------
Invoke-GitHubAPI:
Invoke-GitHubAPI:
Exception: Response status code does not indicate success: 403 (Forbidden).

It's a shame because it works like a breeze.

[MariusStorhaug]

@Manbearpiet, Again thank you for the feedback.

I have not gotten into testing this scenario just yet. Mostly been using it as a CLI replacement as its neat with piping commands into each other. Your use case does make sense how ever. Its on the list for testing. Think there is some spaghetti code on this too that needs tidying up as it was implemented somewhat in a rush to get the auth and secret store working, similarly as it would for GitHubCLI.

Cannot promise a timeline for this though. But let me get on top of GitHub Apps first then verify so I can verify the scenario. I have plans to make a repo and org configurator that takes a setting file and process it with this module, likely using Azure Function Apps or so.

[Manbearpiet]

@Manbearpiet, Again thank you for the feedback.

I have not gotten into testing this scenario just yet. Mostly been using it as a CLI replacement as its neat with piping commands into each other. Your use case does make sense how ever. Its on the list for testing. Think there is some spaghetti code on this too that needs tidying up as it was implemented somewhat in a rush to get the auth and secret store working, similarly as it would for GitHubCLI.

Cannot promise a timeline for this though. But let me get on top of GitHub Apps first then verify so I can verify the scenario. I have plans to make a repo and org configurator that takes a setting file and process it with this module, likely using Azure Function Apps or so.

Hey Marius, I can talk you through it? I also have a blog post coming up about the GitHub Apps part.
Let me know if I can help 😄

[MariusStorhaug]

@Manbearpiet : Also taking a look at this while I'm checking on improvements. The issue here seems to be that the -AccessToken parameters sets the command on a path to use an interactive session for PAT tokens. Would it be typical to run this interactively when using an installation token/JWT? Thinking that you could use the environment variables for this, like $env:GH_TOKEN or $env:GITHUB_TOKEN. When doing so, it will not run into the last issue at hand which is the /user API, which i guess is the main issue.

What would be the preferred way to trigger this logon flow? Parameters or environment var? In either case, do we need another name for it or can we use the existing env var?

[MariusStorhaug]

Fixed #91

[Manbearpiet]

@Manbearpiet : Also taking a look at this while I'm checking on improvements. The issue here seems to be that the -AccessToken parameters sets the command on a path to use an interactive session for PAT tokens. Would it be typical to run this interactively when using an installation token/JWT? Thinking that you could use the environment variables for this, like $env:GH_TOKEN or $env:GITHUB_TOKEN. When doing so, it will not run into the last issue at hand which is the /user API, which i guess is the main issue.

What would be the preferred way to trigger this logon flow? Parameters or environment var? In either case, do we need another name for it or can we use the existing env var?

You got it right in your PR. So will close