GitHub: allow using different tokens for GHCR and API

tweag · Jan 3, 2025 · 07e23d9 · 07e23d9
1 parent db824ea
commit 07e23d9
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 5 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -59,6 +59,7 @@ jobs:
       run: bazelisk test "//examples:integration_tests"
       env:
         GH_TOKEN: ${{ secrets.GH_TOKEN }}
+        GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
         R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
 

diff --git a/authenticate/github/github.go b/authenticate/github/github.go
@@ -23,7 +23,7 @@ import (
 type GitHub struct{}
 
 func (g *GitHub) Resolver(ctx context.Context) (api.Resolver, error) {
-	source, err := selectTokenSource()
+	source, err := selectTokenSource(tokenPurposeAPI)
 	if err != nil {
 		return nil, err
 	}
@@ -48,7 +48,7 @@ func GitHubContainerRegistry() *oci.OCI {
 		},
 	}
 	resolver := func(ctx context.Context) (map[string]func(registry, service, realm string) (oci.AuthConfig, error), error) {
-		source, err := selectTokenSource()
+		source, err := selectTokenSource(tokenPurposeGHCR)
 		if err != nil {
 			return nil, err
 		}
@@ -149,7 +149,14 @@ type GitHubTokenSource struct {
 	token string
 }
 
-func NewGitHubTokenSourceFromEnv() (*GitHubTokenSource, error) {
+func NewGitHubTokenSourceFromEnv(purpose tokenPurpose) (*GitHubTokenSource, error) {
+	if purpose == tokenPurposeGHCR {
+		token, ok := os.LookupEnv("GHCR_TOKEN")
+		if ok {
+			return &GitHubTokenSource{token: token}, nil
+		}
+	}
+
 	token, ok := os.LookupEnv("GH_TOKEN")
 	if ok {
 		return &GitHubTokenSource{token: token}, nil
@@ -216,8 +223,15 @@ type HostConfig struct {
 	OAuthToken string `json:"oauth_token"`
 }
 
-func selectTokenSource() (oauth2.TokenSource, error) {
-	if tokenSource, err := NewGitHubTokenSourceFromEnv(); err == nil {
+type tokenPurpose string
+
+const (
+	tokenPurposeAPI  tokenPurpose = "api"
+	tokenPurposeGHCR tokenPurpose = "ghcr"
+)
+
+func selectTokenSource(purpose tokenPurpose) (oauth2.TokenSource, error) {
+	if tokenSource, err := NewGitHubTokenSourceFromEnv(purpose); err == nil {
 		logging.Basicf("using GitHub token from environment")
 		return tokenSource, nil
 	}