Skip to content

OTA-646: Add GitHub App authentication support to stabilization bot - #10082

Open
shahsahil264 wants to merge 4 commits into
openshift:masterfrom
shahsahil264:OTA-646-github-app-auth
Open

OTA-646: Add GitHub App authentication support to stabilization bot#10082
shahsahil264 wants to merge 4 commits into
openshift:masterfrom
shahsahil264:OTA-646-github-app-auth

Conversation

@shahsahil264

@shahsahil264 shahsahil264 commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds GitHub App authentication as an alternative to PAT-based auth in hack/stabilization-changes.py. This is the code change needed to migrate openshift-ota-bot from a regular GitHub user account to a GitHub App, which fixes the Prow trusted_apps issue (Prow requires the [bot] suffix that only GitHub Apps have).

Changes

  • New flags: --github-app-id and --github-app-private-key-file (with GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY_FILE env var fallbacks)
  • When app credentials are provided, uses PyGithub's AppAuth + GithubIntegration for API calls and x-access-token:<installation_token> for git push
  • Backwards compatible: --github-token / GITHUB_TOKEN continues to work
  • No new dependencies (PyGithub already supports GitHub App auth natively)

Testing

Remaining work (separate tickets)

  1. Create production GitHub App and transfer to openshift-eng org
  2. Install app on openshift/cincinnati-graph-data
  3. Update PSI deployment secrets
  4. Verify Prow trusted_apps works with [bot] suffix
  5. Retire old user account

Bug

https://redhat.atlassian.net/browse/OTA-646

@shahsahil264
hack: Add GitHub App authentication support to stabilization bot
27df7c7 
Add --github-app-id and --github-app-private-key-file flags as an
alternative to --github-token for authenticating with GitHub. This
enables the stabilization bot to run as a GitHub App instead of a
regular user account, which is required for Prow's trusted_apps
config to work (it checks for the [bot] suffix).

Backwards compatible — existing --github-token / GITHUB_TOKEN
continues to work. When both are provided, GitHub App auth takes
precedence.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Signed-off-by: Sahil Shah <sahshah@redhat.com>
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 22, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 22, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

@shahsahil264: This pull request references OTA-646 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Adds GitHub App authentication as an alternative to PAT-based auth in hack/stabilization-changes.py. This is the code change needed to migrate openshift-ota-bot from a regular GitHub user account to a GitHub App, which fixes the Prow trusted_apps issue (Prow requires the [bot] suffix that only GitHub Apps have).

Changes

  • New flags: --github-app-id and --github-app-private-key-file (with GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY_FILE env var fallbacks)
  • When app credentials are provided, uses PyGithub's AppAuth + GithubIntegration for API calls and x-access-token:<installation_token> for git push
  • Backwards compatible: --github-token / GITHUB_TOKEN continues to work
  • No new dependencies (PyGithub already supports GitHub App auth natively)

Testing

Remaining work (separate tickets)

  1. Create production GitHub App and transfer to openshift-eng org
  2. Install app on openshift/cincinnati-graph-data
  3. Update PSI deployment secrets
  4. Verify Prow trusted_apps works with [bot] suffix
  5. Retire old user account

Bug

https://redhat.atlassian.net/browse/OTA-646

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 8e079fb5-fcf5-470f-a1e4-3ab7d0c8e89b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci
openshift-ci Bot requested review from DavidHurta and fao89 July 22, 2026 19:41
@openshift-ci

openshift-ci Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: shahsahil264
Once this PR has been reviewed and has the lgtm label, please assign davidhurta for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@shahsahil264
hack: Fix code review issues in GitHub App auth
248abc8 
- Validate github_app_id and github_app_private_key together to avoid
  falling through to github.Github(None) when only one is provided
- Use integration.get_access_token() public API instead of private
  attribute access via _Github__requester._Requester__auth.token
- Add push_token param to sanitize() to redact app installation tokens
  in error messages
- Rename shadowed 'owner' variable to 'upstream_owner' / 'push_owner'

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Signed-off-by: Sahil Shah <sahshah@redhat.com>
@shahsahil264
hack: Fix remaining code review issues in GitHub App auth
8759513 
- Sanitize push tokens in error messages: promote() now catches push
  exceptions and redacts both github_token and access_token before
  re-raising, so app installation tokens don't leak to logs/Slack
- Single token creation: use get_access_token() and github.Github()
  instead of get_github_for_installation() + get_access_token() which
  created two separate tokens per promote() call
- Validate private key file exists before reading, with clear error

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Signed-off-by: Sahil Shah <sahshah@redhat.com>
wking
wking reviewed Jul 23, 2026
View reviewed changes
Comment thread hack/stabilization-changes.py Outdated
wking
wking reviewed Jul 23, 2026
View reviewed changes
Comment thread hack/stabilization-changes.py Outdated
@shahsahil264
hack: Address review feedback on GitHub App auth
5807077 
- Move int() cast to argparse type=int per Trevor's suggestion
- Remove os.path.exists check — let open() raise naturally

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Signed-off-by: Sahil Shah <sahshah@redhat.com>
@openshift-ci

openshift-ci Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

@shahsahil264: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@shahsahil264
shahsahil264 requested a review from wking July 23, 2026 20:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@DavidHurta DavidHurta Awaiting requested review from DavidHurta
@fao89 fao89 Awaiting requested review from fao89
@wking wking Awaiting requested review from wking

Assignees

No one assigned

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@shahsahil264 @openshift-ci-robot @wking