integrations / integrations/terraform-provider-github
[MAINT]: Rework provider auth configuration
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 1k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 8
Description
### Describe the need
Currently there is some amount of hidden magic involved when figuring out auth for a terraform execution.
1. Get token from ENV
2. Get app_auth from configuration
3. If app_auth block, try to get app installation token
4. If for any reason token would be empty try to use gh CLI to fetch token, but ignore any errors
5. Set token to Meta, no matter if it has a value or not
This makes it quite difficult to actually run anonymously if there is a GITHUB_TOKEN in ENV or gh CLI has any valid auth token.
Additionally there is magic logic for how, at least repo names are being parsed based on auth mode. Token based auth will fetch username from API and ~always use it as owner for any resource, which means that repo names are not full names (/). And for Organizations/Enterprises Owner needs to be set in provider config and repo names etc. need to be full names (/). This leads to very confusing behaviour
### Proposed rework:
1. Make every provider config settable from environment, to allow switching between token and app_auth with the same configuration.
2. Change auth configuration to have all options as explicit options
- auth_mode: anonymous, token, app_auth
- environment_variable_prefix: to enable having multiple providers with env vars configured
- remove app_auth block an move app_auth variables to top-level or enable setting app_auth via env variable
- auth_type: user, organization, enterprise
3. Ensure that token and app_auth always use the same logic for determining owner
### Related issues & PRs:
- We currently have no way of informing the user when no token is set, but they want to do authenticated actions: https://github.com/integrations/terraform-provider-github/issues/598
- There used to be a provider configuration option `anonymous: true`, but it's been removed at some point https://github.com/integrations/terraform-provider-github/issues/354
- Sometimes the used auth isn't what the user/API is expecting: https://github.com/integrations/terraform-provider-github/issues/769
### Code of Conduct
- [x] I agree to follow this project's Code of Conduct
Contributor guide
Assessment
This issue has not been assessed yet.