feat: add GitHub App authentication support#5327
Merged
Merged
Conversation
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## v2 #5327 +/- ##
==========================================
+ Coverage 60.54% 60.66% +0.11%
==========================================
Files 138 138
Lines 13594 13681 +87
==========================================
+ Hits 8231 8299 +68
- Misses 4664 4680 +16
- Partials 699 702 +3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
erka
force-pushed
the
rd/v2/github-app
branch
from
January 28, 2026 23:54
b1318cb to
3e28514
Compare
erka
force-pushed
the
rd/v2/github-app
branch
2 times, most recently
from
January 29, 2026 15:19
b0a23ee to
c633edd
Compare
Contributor
|
👋 Hi @erka! Thanks for your contribution to this project. It looks like one or more of your commits are missing a DCO (Developer Certificate of Origin) sign-off. The DCO is a simple way for you to certify that you have the right to submit this code under the project's license. How to fix this: # For future commits, use the -s flag
git commit -s -m "Your commit message"
# To sign off on existing commits in this PR
git rebase HEAD~$(git rev-list --count origin/v2..HEAD) --signoff
git push --force-with-leaseThe 📋 View the failing DCO check for more details For more information about the DCO, visit: https://developercertificate.org/ |
1 similar comment
Contributor
|
👋 Hi @erka! Thanks for your contribution to this project. It looks like one or more of your commits are missing a DCO (Developer Certificate of Origin) sign-off. The DCO is a simple way for you to certify that you have the right to submit this code under the project's license. How to fix this: # For future commits, use the -s flag
git commit -s -m "Your commit message"
# To sign off on existing commits in this PR
git rebase HEAD~$(git rev-list --count origin/v2..HEAD) --signoff
git push --force-with-leaseThe 📋 View the failing DCO check for more details For more information about the DCO, visit: https://developercertificate.org/ |
erka
force-pushed
the
rd/v2/github-app
branch
4 times, most recently
from
February 5, 2026 22:45
2af4041 to
0ff83bc
Compare
erka
marked this pull request as ready for review
February 5, 2026 23:17
dosubot
Bot
added
the
size:XL
|
Documentation Updates 1 document(s) were updated by changes in this PR: Flipt SCM Providers and Git IntegrationView Changes@@ -10,15 +10,40 @@
Each provider supports both cloud-hosted and self-hosted instances. For self-hosted deployments, specify the provider’s API URL in your environment configuration.
## Authentication Methods
-Authentication is configured per provider using credentials in your Flipt configuration. Supported methods include Personal Access Tokens (PAT), API tokens, and SSH keys. The recommended authentication format varies by provider:
-
-| Provider | Recommended Auth Method | Basic Auth Format | Notes |
-|------------------|------------------------|----------------------------------------|------------------------------------|
-| GitHub | Personal Access Token | Username: token, Password: (empty) | |
-| GitLab | Personal Access Token | Username: oauth2, Password: token | |
-| Bitbucket | API Token | Username: (not used), Token: api_token | App passwords deprecated Sept 2025 |
-| Azure DevOps | Personal Access Token | Username: username, Password: PAT | |
-| Gitea | Personal Access Token | Username: token, Password: (empty) | |
+Authentication is configured per provider using credentials in your Flipt configuration. Supported methods include Personal Access Tokens (PAT), API tokens, SSH keys, and (for GitHub) GitHub App authentication. The recommended authentication format varies by provider:
+
+| Provider | Recommended Auth Method | Basic Auth Format | Notes |
+|------------------|-------------------------------|----------------------------------------|------------------------------------|
+| GitHub | Personal Access Token or GitHub App | Username: token, Password: (empty) | GitHub App authentication supported |
+| GitLab | Personal Access Token | Username: oauth2, Password: token | |
+| Bitbucket | API Token | Username: (not used), Token: api_token | App passwords deprecated Sept 2025 |
+| Azure DevOps | Personal Access Token | Username: username, Password: PAT | |
+| Gitea | Personal Access Token | Username: token, Password: (empty) | |
+
+**GitHub App Authentication:**
+
+Flipt supports authenticating to GitHub and GitHub Enterprise using a GitHub App. This is recommended for organizations that require granular permissions and improved security over personal access tokens. To use GitHub App authentication, create a GitHub App with the necessary permissions (typically `contents` and `pull-requests`), install it on your repository, and generate a private key.
+
+Configure your credentials in Flipt as follows:
+
+```yaml
+credentials:
+ github_app:
+ type: github_app
+ github_app:
+ client_id: <your-github-app-client-id>
+ installation_id: <your-github-app-installation-id>
+ private_key_path: "/path/to/private-key.pem" # or use private_key_bytes instead
+ # api_url: "https://github.company.com/api/v3" # for GitHub Enterprise (optional)
+```
+
+- `client_id`: The App's Client ID (from GitHub App settings)
+- `installation_id`: The installation ID for your repository/organization
+- `private_key_path`: Path to the PEM-encoded private key file for the App
+- `private_key_bytes`: (alternative to private_key_path) The PEM-encoded private key as a string
+- `api_url`: (optional) The GitHub API URL for GitHub Enterprise
+
+You must provide exactly one of `private_key_path` or `private_key_bytes`. If both are provided, Flipt will return an error.
**SSH Remote URL Normalization and Port Handling:**
@@ -28,7 +53,7 @@
**Provider Requirements:**
-- **GitHub:** PAT with `contents` and `pull-requests` scopes.
+- **GitHub:** PAT with `contents` and `pull-requests` scopes, or GitHub App with equivalent permissions.
- **GitLab:** PAT with `api`, `read_repository`, and `write_repository` scopes.
- **Bitbucket Cloud:** API tokens (recommended) with repository and pull request scopes. App passwords deprecated June 2026.
- **Bitbucket Server/Data Center:** Access tokens with repository and pull request permissions.
@@ -42,7 +67,16 @@
github:
type: access_token
access_token: <your-personal-access-token>
-```
+ github_app:
+ type: github_app
+ github_app:
+ client_id: <your-github-app-client-id>
+ installation_id: <your-github-app-installation-id>
+ private_key_path: "/path/to/private-key.pem"
+```
+
+You can reference either credential in your storage backend configuration depending on your organization's requirements.
+
## Pull Request Creation and Management
Flipt v2 models pull request workflows through its "merge proposals" feature. When you create a branch of an environment, Flipt uses Git to create a complete copy of the base environment. Merge proposals allow you to review and approve changes before merging, mirroring workflows found in GitHub Pull Requests, GitLab Merge Requests, and Bitbucket Pull Requests. Merge proposals require a Pro license.
@@ -176,7 +210,6 @@
```
### SSH Remote URL Normalization and Port Support
-
When configuring a storage backend with SSH credentials, Flipt supports specifying the `remote` URL in any of the following formats:
- HTTPS: `https://github.com/org/repo.git`How did I do? Any feedback? |
Signed-off-by: Roman Dmytrenko <[email protected]>
Signed-off-by: Roman Dmytrenko <[email protected]>
markphelps
reviewed
Feb 6, 2026
markphelps
left a comment
markphelps
left a comment
Collaborator
There was a problem hiding this comment.
looks great just one question
| return fmt.Sprintf("%s - %s/%d", g.Name(), g.ClientID(), g.InstallationID()) | ||
| } | ||
|
|
||
| func (g *GitHubAppCredentials) SetAuth(r *http.Request) { |
Contributor
Author
There was a problem hiding this comment.
This is the implementation of go-git githttp.AuthMethod interface.
markphelps
reviewed
Feb 6, 2026
| logger: logger, | ||
| clientID: c.ClientID, | ||
| installationID: c.InstallationID, | ||
| privateKey: privateKey, |
Collaborator
There was a problem hiding this comment.
do we need to store the privateKey on the struct?
Signed-off-by: Roman Dmytrenko <[email protected]>
erka
force-pushed
the
rd/v2/github-app
branch
from
February 6, 2026 23:14
05b3c42 to
efc9676
Compare
markphelps
approved these changes
Feb 7, 2026
markphelps
left a comment
markphelps
left a comment
Collaborator
There was a problem hiding this comment.
ship it! i'll include the PRs merged today in a new 2.6 release and work on docs. ty!!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #5322