Git clone from private github repository with Github Actions token

Question

I need to do some directory grooming before my app is ready to be tested or deployed. I would like to utilize a Makefile target which calls a shell script in the repo to make this CI/CD-agnostic. One can call this target with make prepare_directory

The CI platform I am using is Github Actions. Here are the relevant parts of the workflow which is being run on new Pull Requests:

name: PR Tests
env:
  GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 1
      - name: Prep directoy
        run: make prepare_directory

Here is the relevant part of the Makefile (which works exactly as expected locally):

...
prepare_directory:
    ./scripts/prepare_directory.sh

clean:
    @rm -Rf ./$(BUILDPREFIX)

.PHONY: all clean docker lint prep_avro $(dockerbuilds)

Here is the relevant part of the ./scripts/prepare-directory.sh script:

#!/bin/bash -e
# ...
# clone repo using https and GITHUB_TOKEN
git clone https://[email protected]:USERNAME/REPO.git

When I try to clone using that URL, from the shell script, the script fails (along with the Github workflow pipeline) with the following error: fatal: unable to access 'https://github.com:USERNAME/REPO.git/': URL using bad/illegal format or missing URL

Does anybody know what I'm doing wrong?

Answer 1

I've created a GitHub App and Github Action to workaround these limitations GitHub Actions Access Manager. Feel free to drop some feedback.

Workflow

1. This GitHub action will request an access token for a Target Repository from the App Server, authorize by the GitHub Action ID Token (JWT signed by GitHub).
2. The App Server requests a GitHub App Installation Token to read .github/access.yaml file in Target Repository.
3. The App Server reads .github/access.yaml file from Target Repository and determine which permissions should be granted to Requesting Repository, authorized by the GitHub App Installation Token from step 2..
4. The App Server requests a GitHub App Installation Token with granted permissions for Source Directory and send it back in response to the GitHub action from step 1..
5. The GitHub action sets the token as environment variable $GITHUB_ACCESS_TOKEN and as step output value ${{ steps.github-actions-access.outputs.token }}.
6. Further steps can then utilize this token to access resources of the Target Repository.

Answer 2

The URL in your prepare-directory.sh script's git clone call has a typo in it:

# clone repo using https and GITHUB_TOKEN
git clone https://[email protected]:USERNAME/REPO.git

The URL there is halfway between an HTTPS git URL and an SSH one. The : should be a /. Assuming your $GIT_TOKEN contains just the token and nothing else, you'd also need a : before the @:

git clone https://$GIT_TOKEN:@github.com/USERNAME/REPO.git

If your $GIT_TOKEN contained the complete auth string, which for a Github App installation access token would be something like "x-access-token:ghs_..." then you wouldn't need the : following $GIT_TOKEN, you'd just have [email protected].