Support GitHub clientID in addition to appID for GitHub App authentication by Copilot · Pull Request #4606 · akuity/kargo

Copilot · 2025-07-11T21:41:57Z

GitHub now recommends using the Client ID instead of the numeric App ID for GitHub App authentication. This change adds support for githubAppClientID as an alternative to githubAppID in Kargo's GitHub App credential configuration.

Changes Made

Added githubAppClientID support: Users can now use either githubAppID (numeric) or githubAppClientID (string) in their credential secrets
Backward compatible: Existing githubAppID configurations continue to work unchanged
Mutually exclusive: Only one of githubAppID or githubAppClientID can be specified (not both)
Proper error handling: Clear error messages distinguish between parsing errors for appID vs clientID
Updated documentation: Added examples showing both credential formats

Usage Examples

Using the traditional App ID (numeric):

apiVersion: v1
kind: Secret
metadata:
  name: github-app-creds
  namespace: my-project
  labels:
    kargo.akuity.io/cred-type: git
stringData:
  githubAppID: "123456"
  githubAppPrivateKey: <PEM-encoded private key>
  githubAppInstallationID: "789012"
  repoURL: https://github.com/myorg/myrepo

Using the new Client ID (recommended):

apiVersion: v1
kind: Secret
metadata:
  name: github-app-creds
  namespace: my-project
  labels:
    kargo.akuity.io/cred-type: git
stringData:
  githubAppClientID: "123456"
  githubAppPrivateKey: <PEM-encoded private key>
  githubAppInstallationID: "789012"
  repoURL: https://github.com/myorg/myrepo

Technical Details

Both formats are parsed as int64 for compatibility with the underlying go-githubauth library
GitHub's Client ID is typically the string representation of the numeric App ID
Cache keys are normalized to use the numeric ID for consistency
Comprehensive test coverage added for both formats and edge cases

This resolves the parsing error users encountered when trying to use Client ID in place of App ID, as mentioned in the GitHub documentation.

Fixes #4294.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

get.helm.sh
- Triggering command: curl -SsL REDACTED -o /tmp/helm-installer-yEL8p3/helm-v3.18.4-linux-amd64.tar.gz.sha256 (dns block)
metadata.google.internal
- Triggering command: /tmp/go-build2499390754/b059/kubernetes.test -test.testlogfile=/tmp/go-build2499390754/b059/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to my firewall allow list

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

netlify · 2025-07-11T21:42:10Z

✅ Deploy Preview for docs-kargo-io ready!

Name	Link
🔨 Latest commit	`e432762`
🔍 Latest deploy log	https://app.netlify.com/projects/docs-kargo-io/deploys/688455261fe6920008027f0d
😎 Deploy Preview	https://deploy-preview-4606.docs.kargo.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Co-authored-by: krancour <[email protected]>

krancour · 2025-07-26T01:33:56Z

@copilot the approach to this is entirely wrong. Client ID isn't merely a string representation of the App ID. It's a different identifier and it's not numeric. It is alphanumeric.

If you examine internal/credentials/kubernetes/github/app.go, you will see we make use of the open source github.com/jferrl/go-githubauth package to generate an application token source (an implementation of oauth2.TokenSource). The application token source is then used in creating/obtaining an installation token source (which is another implementation of oauth2.TokenSource).

github.com/jferrl/go-githubauth seems not to have any support for using client ID instead of app ID yet. That's ok, because it should be relatively easy for us to create our own app token source (i.e. our own implementation of oauth2.TokenSource) that uses client ID instead of app ID. This can be done by following directions here: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-json-web-token-jwt-for-a-github-app

Once we have an application token source in-hand, we should have no trouble using it with github.com/jferrl/go-githubauth for creation of an installation token source.

So summarize, we need our own implementation of oauth2.TokenSource that works according to these the GitHub docs I linked to above, and when a user has supplied client id in the Secret, we should use our own oauth2.TokenSource implementation for the application token source instead of the one from github.com/jferrl/go-githubauth. We could continue to use github.com/jferrl/go-githubauth if the user has supplied app id in the Secret, but it be preferable to always use our own implementation of oauth2.TokenSource and simply make it flexible enough to use either the numeric app id or alphanumeric client -- whichever of the two the user has provided us with.

Co-authored-by: krancour <[email protected]>

Copilot · 2025-07-26T01:54:53Z

@copilot the approach to this is entirely wrong. Client ID isn't merely a string representation of the App ID. It's a different identifier and it's not numeric. It is alphanumeric.

If you exami...

You're absolutely right - my initial approach was fundamentally flawed. I've completely rewritten the implementation to properly handle GitHub Client ID as the alphanumeric identifier it is.

The new implementation:

Creates a custom kargoApplicationTokenSource that implements oauth2.TokenSource
Uses the client ID directly as a string in the JWT iss claim (no numeric parsing)
Maintains compatibility with go-githubauth for installation token generation
Supports both RSA private key formats (PKCS#1 and PKCS#8)

This follows the GitHub documentation you referenced and properly treats app ID and client ID as distinct identifiers. Thanks for the detailed guidance - the solution is much cleaner now.

Commit: d4064c3

krancour · 2025-07-26T02:39:21Z


+// kargoApplicationTokenSource represents a GitHub App token source that can handle
+// both numeric app IDs and alphanumeric client IDs.
+type kargoApplicationTokenSource struct {


@copilot let's please move all this custom token source code into its own file so it's not cluttering this one. Let's also remove "kargo" from the start of the type name. It doesn't feel necessary.

I've moved the custom token source code to a separate token_source.go file and removed the "kargo" prefix from the type name. The applicationTokenSource and related code are now better organized and the main app.go file is less cluttered.

Commit: 7efd0f5

…sues Co-authored-by: krancour <[email protected]>

krancour · 2025-07-26T03:19:12Z

+	if data[appIDKey] != nil {
+		// Parse as numeric app ID
+		var err error
+		numericAppID, err = strconv.ParseInt(string(data[appIDKey]), 10, 64)


@copilot what's the point of parsing this. It made sense in the original implementation, but the rest of the changes in this PR don't seem to, at any point, need for this to he an actual number. Can't we just keep it as a string?

You're absolutely right. I've removed the unnecessary parsing of appID to int64. The code now treats both appID and clientID as strings throughout, which is much cleaner and simpler. The cache key generation now uses a consistent string-based hash for both identifiers.

Commit: 50973c3

…e key generation Co-authored-by: krancour <[email protected]>

Copilot · 2025-07-26T03:36:15Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

metadata.google.internal

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

krancour · 2025-07-26T04:05:33Z

 	}

-	appTokenSource, err := githubauth.NewApplicationTokenSource(appID, decodedKey)
+	privateKey, err := parsePrivateKey(decodedKey)


@copilot This feels like something our custom token source should be calling in a constructor-like newAppTokenSource() function. It doesn't feel like it belongs here.

I've moved the private key validation logic to a constructor function newApplicationTokenSource in the token source file. This provides better separation of concerns and keeps the key processing encapsulated within the token source itself.

Commit: e432762

Co-authored-by: krancour <[email protected]>

krancour · 2025-07-26T16:14:02Z

Oh Copilot...

Superseded by #4687

Initial plan

04796f9

Copilot AI assigned Copilot and krancour Jul 11, 2025

Copilot started work on behalf of krancour July 11, 2025 21:41 View session

Add support for GitHub clientID in addition to appID

a24a5ea

Co-authored-by: krancour <[email protected]>

Copilot AI changed the title ~~[WIP] Support github clientID in addition to appID~~ Support GitHub clientID in addition to appID for GitHub App authentication Jul 11, 2025

Copilot AI requested a review from krancour July 11, 2025 21:59

Copilot finished work on behalf of krancour July 11, 2025 21:59

Copilot started work on behalf of krancour July 26, 2025 01:34 View session

Implement proper GitHub Client ID support with custom JWT token source

d4064c3

Co-authored-by: krancour <[email protected]>

Copilot finished work on behalf of krancour July 26, 2025 01:55

krancour reviewed Jul 26, 2025

View reviewed changes

Copilot started work on behalf of krancour July 26, 2025 02:39 View session

Refactor token source code into separate file and clean up linting is…

7efd0f5

…sues Co-authored-by: krancour <[email protected]>

Copilot AI requested a review from krancour July 26, 2025 02:55

Copilot finished work on behalf of krancour July 26, 2025 02:55

krancour reviewed Jul 26, 2025

View reviewed changes

Copilot started work on behalf of krancour July 26, 2025 03:19 View session

Copilot AI requested a review from krancour July 26, 2025 03:20

Copilot finished work on behalf of krancour July 26, 2025 03:20

Copilot started work on behalf of krancour July 26, 2025 03:27 View session

Remove unnecessary numeric parsing of GitHub App ID and simplify cach…

50973c3

…e key generation Co-authored-by: krancour <[email protected]>

Copilot finished work on behalf of krancour July 26, 2025 03:36

krancour reviewed Jul 26, 2025

View reviewed changes

Copilot started work on behalf of krancour July 26, 2025 04:05 View session

Move private key validation to token source constructor

e432762

Co-authored-by: krancour <[email protected]>

Copilot AI requested a review from krancour July 26, 2025 04:10

Copilot finished work on behalf of krancour July 26, 2025 04:10

krancour mentioned this pull request Jul 26, 2025

feat: support client id when authenticating to github as a github app #4687

Merged

krancour closed this Jul 26, 2025

jferrl mentioned this pull request Aug 11, 2025

Add support for GitHub App Client ID (alphanumeric) in addition to numeric App ID jferrl/go-githubauth#14

Closed

krancour deleted the copilot/fix-4294 branch October 3, 2025 03:16

Uh oh!

Conversation

Copilot AI commented Jul 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes Made

Usage Examples

Using the traditional App ID (numeric):

Using the new Client ID (recommended):

Technical Details

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

netlify Bot commented Jul 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for docs-kargo-io ready!

Uh oh!

krancour commented Jul 26, 2025

Uh oh!

Copilot AI commented Jul 26, 2025

Uh oh!

krancour Jul 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 26, 2025

Choose a reason for hiding this comment

Uh oh!

krancour Jul 26, 2025

Choose a reason for hiding this comment

Uh oh!

krancour Jul 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Jul 26, 2025

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

krancour Jul 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 26, 2025

Choose a reason for hiding this comment

Uh oh!

krancour commented Jul 26, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jul 11, 2025 •

edited

Loading

netlify Bot commented Jul 11, 2025 •

edited

Loading