feat: add GitHub App Authentication as an option for DagBundles#64422
feat: add GitHub App Authentication as an option for DagBundles#64422RaphCodec wants to merge 22 commits intoapache:mainfrom
Conversation
|
Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide (https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
|
0639a51 to
d080795
Compare
|
@RaphCodec Converting to draft — this PR doesn't yet meet our Pull Request quality criteria.
See the linked criteria for how to fix each item, then mark the PR "Ready for review". This is not a rejection — just an invitation to bring the PR up to standard. No rush. Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. Once you have addressed the points above, an Apache Airflow maintainer — a real person — will take the next look at your PR. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you. |
There was a problem hiding this comment.
Pull request overview
Adds GitHub App-based authentication support to the Git provider’s GitHook so Git-backed DagBundles can authenticate to GitHub without SSH deploy keys (using an installation access token instead).
Changes:
- Extend
GitHookconnection extras/UI placeholders to accept GitHub App identifiers and generate an installation token for HTTPS cloning. - Add an optional dependency extra for GitHub App support (
pygithub/PyGithub) in the git provider. - Update the workspace lockfile to include the new optional extra and reflect a refreshed dependency resolution.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
providers/git/src/airflow/providers/git/hooks/git.py |
Adds GitHub App auth fields and token generation logic to rewrite HTTPS repo URLs with an installation token. |
providers/git/pyproject.toml |
Introduces an optional dependency extra for GitHub App support. |
uv.lock |
Updates the lockfile to include the new optional extra and updated resolved packages. |
1abb9fb to
23cf74d
Compare
687fb39 to
533e92f
Compare
|
Thanks for the feedback. I went over the code more thourghly, improved it and updated the branch. I will try to update the branch at least once a day to prevent merge conflicts. |
27884e7 to
a2d5a9a
Compare
|
@RaphCodec Converting to draft — this PR doesn't yet meet our Pull Request quality criteria.
See the linked criteria for how to fix each item, then mark the PR "Ready for review". This is not a rejection — just an invitation to bring the PR up to standard. No rush. Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. Once you have addressed the points above, an Apache Airflow maintainer — a real person — will take the next look at your PR. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you. |
d6d8755 to
e432d3f
Compare
Co-authored-by: Copilot <[email protected]>
copilot suggestion Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
…nstallation id Co-authored-by: Copilot <[email protected]>
…ith_key_file_reads_file Co-authored-by: Copilot <[email protected]>
… treated as an ssh key by mistake
e432d3f to
7ed0886
Compare
Purpose
Adding GitHub App Authentication to the Git Provider. This feature is intended to be a security benefit for those who want to use GitHub Dag Bundles in Airflow 3, but for whatever reason cannot use a SSH deploy key to authenticate to GitHub and would prefer not to use their own PAT.
In case of an existing issue, reference it using one of the following:
Was generative AI tooling used to co-author this PR?
{pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.