metastore-lib is likely to be installed as a GitHub App for many users. For this reason, we should probably do better to support GitHub App Installation access tokens out of the box.
This requires supporting a more complex flow than just "give me a token and go" which is good for personal access tokens. This flow is currently not supported by PyGitHub so we need to implement it ourselves and just pass the resulting access token to PyGitHub:
Acceptance Criteria
Technical Flow of authenticating as an app
- User has to install the app and get a private key as a PEM file
- metastore-lib needs an app ID and the PEM key
- metastore-lib generates a JWT token as described here: https://docs.github.com/en/developers/apps/authenticating-with-github-apps#authenticating-as-a-github-app
- metastore-lib uses said JWT token to obtain an installation access token as described here: https://docs.github.com/en/developers/apps/authenticating-with-github-apps#authenticating-as-an-installation
- Once auth token is obtained it can be used with PyGithub
- Cache access token for up to 1 hour (exp time should be provided with token, it would be wise to take a minute of grace to allow for clock drift etc.)
- Once token is expired / not available, go back to step 3
metastore-lib is likely to be installed as a GitHub App for many users. For this reason, we should probably do better to support GitHub App Installation access tokens out of the box.
This requires supporting a more complex flow than just "give me a token and go" which is good for personal access tokens. This flow is currently not supported by PyGitHub so we need to implement it ourselves and just pass the resulting access token to PyGitHub:
Acceptance Criteria
Technical Flow of authenticating as an app