|
| 1 | +"""GitHub credentials integration for Seqera Platform.""" |
| 2 | + |
| 3 | +import pulumi |
| 4 | +import pulumi_seqera as seqera |
| 5 | +from typing import Dict, Tuple |
| 6 | + |
| 7 | + |
| 8 | +class GitHubCredentialError(Exception): |
| 9 | + """Exception raised when GitHub credential creation fails.""" |
| 10 | + |
| 11 | + pass |
| 12 | + |
| 13 | + |
| 14 | +def create_github_credential( |
| 15 | + seqera_provider: seqera.Provider, |
| 16 | + workspace_id: int, |
| 17 | + github_token: str, |
| 18 | + github_username: str = "nf-core-bot", |
| 19 | + credential_name: str = "nf-core-github-finegrained", |
| 20 | +) -> Tuple[seqera.Credential, str]: |
| 21 | + """Create a GitHub fine-grained credential in Seqera Platform. |
| 22 | +
|
| 23 | + This credential allows Seqera Platform to pull pipeline repositories from GitHub |
| 24 | + without hitting GitHub rate limits. The fine-grained token provides secure, |
| 25 | + scoped access to nf-core repositories with minimal required permissions. |
| 26 | +
|
| 27 | + Args: |
| 28 | + seqera_provider: Configured Seqera provider instance |
| 29 | + workspace_id: Seqera workspace ID |
| 30 | + github_token: Fine-grained GitHub personal access token for repository access |
| 31 | + github_username: GitHub username (default: nf-core-bot) |
| 32 | + credential_name: Name for the credential in Seqera |
| 33 | +
|
| 34 | + Returns: |
| 35 | + Tuple of (credential_resource, credential_id) |
| 36 | +
|
| 37 | + Raises: |
| 38 | + GitHubCredentialError: If credential creation fails |
| 39 | + ValueError: If required parameters are missing |
| 40 | + """ |
| 41 | + # Validate required parameters |
| 42 | + if not github_token: |
| 43 | + raise ValueError("GitHub token is required") |
| 44 | + if not workspace_id: |
| 45 | + raise ValueError("Workspace ID is required") |
| 46 | + |
| 47 | + pulumi.log.info( |
| 48 | + f"Creating GitHub credential '{credential_name}' in workspace {workspace_id}" |
| 49 | + ) |
| 50 | + |
| 51 | + try: |
| 52 | + # Create GitHub credential using Seqera Terraform provider |
| 53 | + github_credential = seqera.Credential( |
| 54 | + f"github-credential-{credential_name}", |
| 55 | + name=credential_name, |
| 56 | + description="Fine-grained GitHub token to avoid rate limits when Platform pulls pipeline repositories", |
| 57 | + provider_type="github", |
| 58 | + base_url="https://github.com/nf-core/", # Scope to nf-core organization |
| 59 | + keys=seqera.CredentialKeysArgs( |
| 60 | + github=seqera.CredentialKeysGithubArgs( |
| 61 | + username=github_username, |
| 62 | + password=github_token, # GitHub tokens go in the password field |
| 63 | + ) |
| 64 | + ), |
| 65 | + workspace_id=workspace_id, |
| 66 | + opts=pulumi.ResourceOptions( |
| 67 | + provider=seqera_provider, |
| 68 | + protect=True, # Protect credential from accidental deletion |
| 69 | + ), |
| 70 | + ) |
| 71 | + |
| 72 | + # Return both the resource and the credential ID for reference |
| 73 | + return github_credential, github_credential.id |
| 74 | + |
| 75 | + except Exception as e: |
| 76 | + pulumi.log.error(f"Failed to create GitHub credential: {str(e)}") |
| 77 | + raise GitHubCredentialError( |
| 78 | + f"GitHub credential creation failed: {str(e)}" |
| 79 | + ) from e |
| 80 | + |
| 81 | + |
| 82 | +def get_github_credential_config() -> Dict[str, str]: |
| 83 | + """Get configuration for GitHub credential creation. |
| 84 | +
|
| 85 | + Returns: |
| 86 | + Dict containing configuration values from ESC environment |
| 87 | + """ |
| 88 | + import os |
| 89 | + |
| 90 | + return { |
| 91 | + "github_finegrained_token": os.environ.get("PLATFORM_GITHUB_ORG_TOKEN", ""), |
| 92 | + "github_username": os.environ.get("GITHUB_USERNAME", "nf-core-bot"), |
| 93 | + "credential_name": os.environ.get( |
| 94 | + "GITHUB_CREDENTIAL_NAME", "nf-core-github-finegrained" |
| 95 | + ), |
| 96 | + } |
0 commit comments