Add possibility to set username for the git-resolver by MarcusElevait · Pull Request #9543 · tektoncd/pipeline

MarcusElevait · 2026-03-10T07:41:32Z

… git resolver

Changes

When using the git resolver with a private Bitbucket cloud repository, you need to consider two things:

When using the git clone resolver the username must be set to "x-token-auth"
When using the rest api the scm client need to use a username

Currently for the git clone resolver the username is always set to "git". For the rest api there is no username set at all.
With my changes you can define a username within the secret of the token, which is then used in the respective resolver.

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

Has Docs if any changes are user facing, including updates to minimum requirements e.g. Kubernetes version bumps
Has Tests included if any functionality added or changed
pre-commit Passed
Follows the commit message standard
Meets the Tekton contributor standards (including functionality, content, code)
Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings). See some examples of good release notes.
Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

Username can be set for git-resolver

… git resolver Prior to this commit, there was no possibility to configure a username for the git resolver, neither for clone nor for api. Added the possibility to set the username via the token secret.

linux-foundation-easycla · 2026-03-10T07:41:40Z

The committers listed above are authorized under a signed CLA.

✅ login: MarcusElevait / name: Marcus Trepte (da31adb, df65eec)

tekton-robot · 2026-03-10T07:41:41Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign abayer after the PR has been reviewed.
You can assign the PR to them by writing /assign @abayer in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

MarcusElevait · 2026-03-10T07:41:46Z

/kind feature

aThorp96

Thanks for the contribution @MarcusElevait!

I have a couple minor suggestions and two requests. The only blocking requests are to either remove or use the global git resolver config for the username field (I don't think it's necessary, personally, but not opposed to keeping it), since it's currently unused outside of tests, and to modify the test TestResolve to check that the username is propagated to the clientfunc and git request, respectively.

aThorp96 · 2026-03-10T15:37:21Z

docs/git-resolver.md

-| `revision`    | Git revision to checkout a file from. This can be commit SHA (SHA-1 or SHA-256), branch or tag.                                                                                               | `aeb957601cf41c012be462827053a21a420befca` `main` `v0.38.2` |
+| `gitToken`    | An optional secret name in the `PipelineRun` namespace to fetch the token from when doing opration with the `git clone`. When empty it will use anonymous cloning.         | `secret-gitauth-token` |
+| `gitTokenKey` | An optional key in the token secret name in the `PipelineRun` namespace to fetch the token from when using the `git clone`. Defaults to `token`.                           | `token`                                                     |
+| `username`    | An optional key in the token secret name in the `PipelineRun` namespace to fetch the username from. Defaults to `username`.                                                |                                                             |


Please include an example value:

Suggested change

| `username` | An optional key in the token secret name in the `PipelineRun` namespace to fetch the username from. Defaults to `username`. | |

| `username` | An optional key in the token secret name in the `PipelineRun` namespace to fetch the username from. Defaults to `username`. | `username` |

aThorp96 · 2026-03-10T15:37:32Z

docs/git-resolver.md

-| `gitToken`       | An optional secret name in the `PipelineRun` namespace to fetch the token from when doing opration with the `git clone`. When empty it will use anonymous cloning. | `secret-gitauth-token` |
-| `gitTokenKey` | An optional key in the token secret name in the `PipelineRun` namespace to fetch the token from when using the `git clone`. Defaults to `token`.                                                      | `token`                                                     |
-| `revision`    | Git revision to checkout a file from. This can be commit SHA (SHA-1 or SHA-256), branch or tag.                                                                                               | `aeb957601cf41c012be462827053a21a420befca` `main` `v0.38.2` |


Thanks for cleaning up this whitespace!

aThorp96 · 2026-03-10T15:40:19Z

docs/git-resolver.md

+| `default-revision`           | The default git revision to use if none is specified                                                                                                          | `main`                                                         |
+| `fetch-timeout`              | The maximum time any single git clone resolution may take. **Note**: a global maximum timeout of 1 minute is currently enforced on _all_ resolution requests. | `1m`, `2s`, `700ms`                                            |
+| `default-url`                | The default git repository URL to use for anonymous cloning if none is specified.                                                                             | `https://github.com/tektoncd/catalog.git`                      |
 | `scm-type`                   | The SCM provider type. Required if using the authenticated API with `org` and `repo`.                                                                         | `github`, `gitlab`, `gitea`, `bitbucketcloud`, `bitbucketserver` |


I think the whitespace alignment for this section is now misaligned with this row

aThorp96 · 2026-03-10T15:58:17Z

docs/git-resolver.md

    # my-secret-token should be created in the namespace where the
    # pipelinerun is created and contain a GitHub personal access
-    # token in the token key of the secret.
+    # token in the token key of the secret and a username depending on the git provider.


Nitpick, rewording this so it's clear "depending on the git provider" refers specifically to the username requirement

Suggested change

# token in the token key of the secret and a username depending on the git provider.

# token in the token key of the secret and, if required by the git provider, a username.

aThorp96 · 2026-03-10T16:03:00Z

pkg/resolution/resolver/git/config.go

 	// APISecretKeyKey is the config map key for the containing the token within the token secret
 	APISecretKeyKey = "api-token-secret-key"
+	// APIUsernameSecretKey is the config map key containing the username within the token secret
+	APIUsernameSecretKey = "api-username-secret-key"


This appears to be unused outside of the tests

aThorp96 · 2026-03-10T16:13:25Z

pkg/resolution/resolver/git/resolver.go

+	token, ok := secret.Data[apiSecret.tokenKey]
 	if !ok {
-		err := fmt.Errorf("cannot get API token, key %s not found in secret %s in namespace %s", apiSecret.key, apiSecret.name, apiSecret.ns)
+		err := fmt.Errorf("cannot get API token, key %s not found in secret %s in namespace %s", apiSecret.tokenKey, apiSecret.name, apiSecret.ns)


Might need a codeQL exception here, this is a safe change flagged by regex. Renaming the variable would work too, since I don't like the idea of disabling this check on a log line

aThorp96 · 2026-03-10T16:22:42Z

pkg/resolution/resolver/git/resolver_test.go

+				if tc.config[tc.configIdentifer+APIUsernameSecretKey] != "" {
+					secretUsernameKey = tc.config[tc.configIdentifer+APIUsernameSecretKey]
 				}


Nitpick, since empty string is also the zero value we can just do this:

Suggested change

if tc.config[tc.configIdentifer+APIUsernameSecretKey] != "" {

secretUsernameKey = tc.config[tc.configIdentifer+APIUsernameSecretKey]

}

secretUsernameKey = tc.config[tc.configIdentifer+APIUsernameSecretKey]

Though this is the only place we reference the username key in the configmap so might not be needed at all

aThorp96 · 2026-03-10T17:56:06Z

pkg/resolution/resolver/git/resolver_test.go

It looks like this adds support for testing that the usernameKey is allowed and ensures the testcase initializes the usernamekey when necessary, however it doesn't appear that the test if the username was given to the git provider or API. When the code in ResolveApiGit and ResolveGitClone that uses the username key is removed, the test still passes

aThorp96 · 2026-03-10T18:05:05Z

pkg/resolution/resolver/git/resolver.go

+type authCredentials struct {
+	token    []byte
+	username []byte
 }

-func (g *GitResolver) getAPIToken(ctx context.Context, apiSecret *secretCacheKey, key string) ([]byte, error) {
+func (g *GitResolver) getAuthenticationCredentials(ctx context.Context, apiSecret *secretCacheKey, key string) (*authCredentials, error) {


I appreciate the use of types here

feat(resolver): add possibility to get username from token secret for…

da31adb

… git resolver Prior to this commit, there was no possibility to configure a username for the git resolver, neither for clone nor for api. Added the possibility to set the username via the token secret.

tekton-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Mar 10, 2026

tekton-robot requested review from abayer and pritidesai March 10, 2026 07:41

tekton-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Mar 10, 2026

tekton-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Mar 10, 2026

fix(resolver): assigning username just if it's there

df65eec

MarcusElevait mentioned this pull request Mar 10, 2026

Git resolver does not support bitbucket cloud authentication #9484

Open

aThorp96 reviewed Mar 10, 2026

View reviewed changes

	\| `username` \| An optional key in the token secret name in the `PipelineRun` namespace to fetch the username from. Defaults to `username`. \| \|
	\| `username` \| An optional key in the token secret name in the `PipelineRun` namespace to fetch the username from. Defaults to `username`. \| `username` \|

	# token in the token key of the secret and a username depending on the git provider.
	# token in the token key of the secret and, if required by the git provider, a username.

Conversation

MarcusElevait commented Mar 10, 2026

Changes

Submitter Checklist

Release Notes

Uh oh!

linux-foundation-easycla bot commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tekton-robot commented Mar 10, 2026

Uh oh!

MarcusElevait commented Mar 10, 2026

Uh oh!

aThorp96 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

linux-foundation-easycla bot commented Mar 10, 2026 •

edited

Loading