Skip to content

Commit c2299aa

Browse files
msukkarimsukkari
authored
feat(auth): github app (#570)
* properly handle emails for github app auth case * add docs info for auth through github app * more info in docs for user auth perms * modify review agent env var names * github app service auth * coderabbit suggestions * fixes * fix build
1 parent 03999f0 commit c2299aa

File tree

31 files changed

+1094
-50
lines changed

31 files changed

+1094
-50
lines changed

‎CHANGELOG.md‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
1111

1212
### Added
1313
- Implement dynamic tab titles for files and folders in browse tab. [#560](https://github.com/sourcebot-dev/sourcebot/pull/560)
14+
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)
15+
- Added support for GitHub Apps for service auth. [#570](https://github.com/sourcebot-dev/sourcebot/pull/570)
1416

1517
### Fixed
1618
- Fixed "dubious ownership" errors when cloning / fetching repos. [#553](https://github.com/sourcebot-dev/sourcebot/pull/553)
@@ -27,9 +29,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
2729
- Removed spam "login page loaded" log. [#552](https://github.com/sourcebot-dev/sourcebot/pull/552)
2830
- Removed connections management page. [#563](https://github.com/sourcebot-dev/sourcebot/pull/563)
2931

30-
### Added
31-
- Added support for passing db connection url as seperate `DATABASE_HOST`, `DATABASE_USERNAME`, `DATABASE_PASSWORD`, `DATABASE_NAME`, and `DATABASE_ARGS` env vars. [#545](https://github.com/sourcebot-dev/sourcebot/pull/545)
32-
3332
## [4.7.3] - 2025-09-29
3433

3534
### Fixed

‎docs/docs/configuration/auth/overview.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ Sourcebot's built-in authentication system gates your deployment, and allows adm
1010
<Card horizontal title="Authentication providers" icon="lock" href="/docs/configuration/auth/providers">
1111
Configure additional authentication providers for your deployment.
1212
</Card>
13-
<Card horizontal title="Inviting members" icon="user" href="/docs/configuration/auth/inviting-members">
13+
<Card horizontal title="Access settings" icon="user" href="/docs/configuration/auth/access-settings">
1414
Learn how to configure how members join your deployment.
1515
</Card>
1616
<Card horizontal title="Roles and permissions" icon="shield" href="/docs/configuration/auth/roles-and-permissions">

‎docs/docs/configuration/auth/providers.mdx‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,13 @@ The following authentication providers require an [enterprise license](/docs/lic
3333

3434
[Auth.js GitHub Provider Docs](https://authjs.dev/getting-started/providers/github)
3535

36+
Authentication using both a **GitHub OAuth App** and a **GitHub App** is supported. In both cases, you must provide Sourcebot the `CLIENT_ID` and `SECRET_ID` and configure the
37+
callback URL correctly (more info in Auth.js docs).
38+
39+
When using a **GitHub App** for auth, enable the following permissions:
40+
- `“Email addresses” account permissions (read)`
41+
- `"Metadata" repository permissions (read)` (only needed if enabling [permission syncing](/docs/features/permission-syncing))
42+
3643
**Required environment variables:**
3744
- `AUTH_EE_GITHUB_CLIENT_ID`
3845
- `AUTH_EE_GITHUB_CLIENT_SECRET`

‎docs/docs/configuration/environment-variables.mdx‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -62,9 +62,9 @@ The following environment variables allow you to configure your Sourcebot deploy
6262
### Review Agent Environment Variables
6363
| Variable | Default | Description |
6464
| :------- | :------ | :---------- |
65-
| `GITHUB_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
66-
| `GITHUB_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
67-
| `GITHUB_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
65+
| `GITHUB_REVIEW_AGENT_APP_ID` | `-` | <p>The GitHub App ID used for review agent authentication.</p> |
66+
| `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH` | `-` | <p>The container relative path to the private key file for the GitHub App used by the review agent.</p> |
67+
| `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET` | `-` | <p>The webhook secret for the GitHub App used by the review agent.</p> |
6868
| `OPENAI_API_KEY` | `-` | <p>The OpenAI API key used by the review agent.</p> |
6969
| `REVIEW_AGENT_API_KEY` | `-` | <p>The Sourcebot API key used by the review agent.</p> |
7070
| `REVIEW_AGENT_AUTO_REVIEW_ENABLED` | `false` | <p>Enables/disables automatic code reviews by the review agent.</p> |

‎docs/docs/features/agents/review-agent.mdx‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
4444
<Step title="Configure the environment variables in Sourcebot">
4545
Sourcebot requires the following environment variables to begin reviewing PRs through your new GitHub app:
4646

47-
- `GITHUB_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
48-
- `GITHUB_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
49-
- `GITHUB_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
47+
- `GITHUB_REVIEW_AGENT_APP_ID`: The client ID of your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
48+
- `GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET`: The webhook secret you defined in your GitHub app. Can be found in your [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings)
49+
- `GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH`: The path to your app's private key. If you're running Sourcebot from a container, this is the path to this file from within your container
5050
(ex `/data/review-agent-key.pem`). You must copy the private key file into the directory you mount to Sourcebot (similar to the config file).
5151

5252
You can generate a private key file for your app in the [app settings](https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/quickstart#navigate-to-your-app-settings). You must copy this private key file into the
@@ -74,9 +74,9 @@ Before you get started, make sure you have an OpenAPI account that you can creat
7474
- "/Users/michael/sourcebot_review_agent_workspace:/data"
7575
environment:
7676
CONFIG_PATH: "/data/config.json"
77-
GITHUB_APP_ID: "my-github-app-id"
78-
GITHUB_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
79-
GITHUB_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
77+
GITHUB_REVIEW_AGENT_APP_ID: "my-github-app-id"
78+
GITHUB_REVIEW_AGENT_APP_WEBHOOK_SECRET: "my-github-app-webhook-secret"
79+
GITHUB_REVIEW_AGENT_APP_PRIVATE_KEY_PATH: "/data/review-agent-key.pem"
8080
REVIEW_AGENT_API_KEY: "sourcebot-my-key"
8181
OPENAI_API_KEY: "sk-proj-my-open-api-key"
8282
```

‎docs/snippets/schemas/v3/app.schema.mdx‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
2+
```json
3+
{
4+
"$schema": "http://json-schema.org/draft-07/schema#",
5+
"title": "AppConfig",
6+
"oneOf": [
7+
{
8+
"$schema": "http://json-schema.org/draft-07/schema#",
9+
"type": "object",
10+
"title": "GithubAppConfig",
11+
"properties": {
12+
"type": {
13+
"const": "githubApp",
14+
"description": "GitHub App Configuration"
15+
},
16+
"deploymentHostname": {
17+
"type": "string",
18+
"format": "hostname",
19+
"default": "github.com",
20+
"description": "The hostname of the GitHub App deployment.",
21+
"examples": [
22+
"github.com",
23+
"github.example.com"
24+
]
25+
},
26+
"id": {
27+
"type": "string",
28+
"description": "The ID of the GitHub App."
29+
},
30+
"privateKey": {
31+
"description": "The private key of the GitHub App.",
32+
"anyOf": [
33+
{
34+
"type": "object",
35+
"properties": {
36+
"secret": {
37+
"type": "string",
38+
"description": "The name of the secret that contains the token."
39+
}
40+
},
41+
"required": [
42+
"secret"
43+
],
44+
"additionalProperties": false
45+
},
46+
{
47+
"type": "object",
48+
"properties": {
49+
"env": {
50+
"type": "string",
51+
"description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
52+
}
53+
},
54+
"required": [
55+
"env"
56+
],
57+
"additionalProperties": false
58+
}
59+
]
60+
}
61+
},
62+
"required": [
63+
"type",
64+
"id"
65+
],
66+
"oneOf": [
67+
{
68+
"required": [
69+
"privateKey"
70+
]
71+
},
72+
{
73+
"required": [
74+
"privateKeyPath"
75+
]
76+
}
77+
],
78+
"additionalProperties": false
79+
}
80+
]
81+
}
82+
```

‎docs/snippets/schemas/v3/githubApp.schema.mdx‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{/* THIS IS A AUTO-GENERATED FILE. DO NOT MODIFY MANUALLY! */}
2+
```json
3+
{
4+
"$schema": "http://json-schema.org/draft-07/schema#",
5+
"type": "object",
6+
"title": "GithubAppConfig",
7+
"properties": {
8+
"type": {
9+
"const": "githubApp",
10+
"description": "GitHub App Configuration"
11+
},
12+
"deploymentHostname": {
13+
"type": "string",
14+
"format": "hostname",
15+
"default": "github.com",
16+
"description": "The hostname of the GitHub App deployment.",
17+
"examples": [
18+
"github.com",
19+
"github.example.com"
20+
]
21+
},
22+
"id": {
23+
"type": "string",
24+
"description": "The ID of the GitHub App."
25+
},
26+
"privateKey": {
27+
"description": "The private key of the GitHub App.",
28+
"anyOf": [
29+
{
30+
"type": "object",
31+
"properties": {
32+
"secret": {
33+
"type": "string",
34+
"description": "The name of the secret that contains the token."
35+
}
36+
},
37+
"required": [
38+
"secret"
39+
],
40+
"additionalProperties": false
41+
},
42+
{
43+
"type": "object",
44+
"properties": {
45+
"env": {
46+
"type": "string",
47+
"description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
48+
}
49+
},
50+
"required": [
51+
"env"
52+
],
53+
"additionalProperties": false
54+
}
55+
]
56+
}
57+
},
58+
"required": [
59+
"type",
60+
"id"
61+
],
62+
"oneOf": [
63+
{
64+
"required": [
65+
"privateKey"
66+
]
67+
},
68+
{
69+
"required": [
70+
"privateKeyPath"
71+
]
72+
}
73+
],
74+
"additionalProperties": false
75+
}
76+
```

‎docs/snippets/schemas/v3/index.schema.mdx‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4273,6 +4273,89 @@
42734273
}
42744274
]
42754275
}
4276+
},
4277+
"apps": {
4278+
"type": "array",
4279+
"description": "Defines a collection of apps that are available to Sourcebot.",
4280+
"items": {
4281+
"$schema": "http://json-schema.org/draft-07/schema#",
4282+
"title": "AppConfig",
4283+
"oneOf": [
4284+
{
4285+
"$schema": "http://json-schema.org/draft-07/schema#",
4286+
"type": "object",
4287+
"title": "GithubAppConfig",
4288+
"properties": {
4289+
"type": {
4290+
"const": "githubApp",
4291+
"description": "GitHub App Configuration"
4292+
},
4293+
"deploymentHostname": {
4294+
"type": "string",
4295+
"format": "hostname",
4296+
"default": "github.com",
4297+
"description": "The hostname of the GitHub App deployment.",
4298+
"examples": [
4299+
"github.com",
4300+
"github.example.com"
4301+
]
4302+
},
4303+
"id": {
4304+
"type": "string",
4305+
"description": "The ID of the GitHub App."
4306+
},
4307+
"privateKey": {
4308+
"anyOf": [
4309+
{
4310+
"type": "object",
4311+
"properties": {
4312+
"secret": {
4313+
"type": "string",
4314+
"description": "The name of the secret that contains the token."
4315+
}
4316+
},
4317+
"required": [
4318+
"secret"
4319+
],
4320+
"additionalProperties": false
4321+
},
4322+
{
4323+
"type": "object",
4324+
"properties": {
4325+
"env": {
4326+
"type": "string",
4327+
"description": "The name of the environment variable that contains the token. Only supported in declarative connection configs."
4328+
}
4329+
},
4330+
"required": [
4331+
"env"
4332+
],
4333+
"additionalProperties": false
4334+
}
4335+
],
4336+
"description": "The private key of the GitHub App."
4337+
}
4338+
},
4339+
"required": [
4340+
"type",
4341+
"id"
4342+
],
4343+
"oneOf": [
4344+
{
4345+
"required": [
4346+
"privateKey"
4347+
]
4348+
},
4349+
{
4350+
"required": [
4351+
"privateKeyPath"
4352+
]
4353+
}
4354+
],
4355+
"additionalProperties": false
4356+
}
4357+
]
4358+
}
42764359
}
42774360
},
42784361
"additionalProperties": false

‎packages/backend/package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
"dependencies": {
2525
"@coderabbitai/bitbucket": "^1.1.3",
2626
"@gitbeaker/rest": "^40.5.1",
27+
"@octokit/app": "^16.1.1",
2728
"@octokit/rest": "^21.0.2",
2829
"@sentry/cli": "^2.42.2",
2930
"@sentry/node": "^9.3.0",

0 commit comments

Comments
 (0)