CredentialType

Credential Type

• Administration - Credential Types

Github App

• Input Configuration

fields:
  - id: github_app_id
    type: string
    label: GitHub App ID
  - id: github_app_installation_id
    type: string
    label: GitHub App Installation ID
  - id: github_app_private_key
    type: string
    label: GitHub App Private Key
    secret: true
    multiline: true
required:
  - github_app_id
  - github_app_installation_id
  - github_app_private_key

• Injector Configuration

env:
  GITHUB_APP_ID: '{{ github_app_id }}'
  GITHUB_APP_INSTALLATION_ID: '{{ github_app_installation_id }}'
  GITHUB_APP_PRIVATE_KEY_PATH: '{{ tower.filename }}'
file: # private key content will be saved in file which filename is defined in tower.filename
  template: |
    {{ github_app_private_key }}

• To use it:

  • Resources > Credentials > New Credentials, then select the credential type that was created earlier

  • Fill in required field such as Github App ID, GitHub App Installation ID and GitHub Private Key in this example

Sample Ansible playbook that use above Github App Credential

• The following variables must be defined

# GitHub App Configuration
github_app_id: "{{ lookup('env', 'GITHUB_APP_ID') }}"
github_app_installation_id: "{{ lookup('env', 'GITHUB_APP_INSTALLATION_ID') }}"
github_app_private_key_path: "{{ lookup('env', 'GITHUB_APP_PRIVATE_KEY_PATH') }}"

- name: Get token from GitHub App
  no_log: true
  block:
    - name: Generate GitHub App JWT
      ansible.builtin.command:
        cmd: |
          python3 -c "
          import jwt
          import time
          with open('{{ github_app_private_key_path }}', 'r') as key_file:
              private_key = key_file.read()
          token = jwt.encode(
              {'iat': int(time.time()), 'exp': int(time.time()) + 600, 'iss': '{{ github_app_id }}'},
              private_key,
              algorithm='RS256'
          )
          print(token)
          "
      register: jwt_token
    
    - name: Get access token using JWT
      shell: |
        curl -X POST -v --proxy-ntlm --proxy {{ proxy_host }} --proxy-user '{{ proxy_user }}:{{ proxy_password }}' -H "Accept: application/vnd.github.v3+json" -H "Authorization: Bearer {{ jwt_token.stdout }}" https://api.github.com/app/installations/{{ github_app_installation_id }}/access_tokens
      register: curl_output
    
    - name: Convert output to JSON object
      set_fact:
        github_token_response: "{{ curl_output.stdout | ansible.builtin.from_json }}"
    
    - name: Set GitHub token fact
      ansible.builtin.set_fact:
        github_token: "{{ github_token_response.token }}"
      delegate_facts: true

Resource

• https://docs.ansible.com/ansible-tower/latest/html/userguide/credential_types.html#getting-started-with-credential-types