CFTL-589 GitHub OAuth as a third git authentication method

[Oscar-XXII]

Why

Cloning a private repository required the customer to create and rotate a credential by hand, and a classic PAT grants read and write across every private repository the user can reach. Enterprise security reviews keep flagging it.

This adds a third git.auth option: authorize a Keboola-owned GitHub App through the OAuth broker and get a user access token limited to Contents: Read-only on the repositories chosen at installation. SSH and PAT are untouched, and no key changes for existing configurations.

What it does

• oauth appended to git.auth. Existing radio order is unchanged.
• One repository field. git.url now serves every authentication method — a select with creatable, moved below the auth switch. OAuth users load the list with List Repositories; everyone else types or pastes the URL. For non-OAuth the action answers Supported only for OAuth. Please insert the URL manually.
• Token handling. The token arrives outside parameters, in the authorization section, and reaches git through a GIT_ASKPASS helper — never in the command line, in .git/config, or in the executed script's environment.
• authorization is stripped from the config.json handed to the user script. It carries the user's token and #appSecret, the shared secret of the Keboola GitHub App, and this component runs arbitrary user code. The security-critical change in this PR; covered by a test.
• listRepositories reads /user/installations then /user/installations/{id}/repositories — a user token carries no installation id of its own. Paginated, aggregated across installations.
• Private git dependencies. uv sync shells out to git with no credentials of its own; SubprocessRunner.run takes an optional env so the dependency install gets them. The executed script still inherits the untouched environment.
• Errors for missing authorization, non-GitHub URL, revoked token, a repository the app cannot see, and a read timeout each produce an actionable UserException.

38 tests, flake8 clean.

Verified

Job 53340777 cloned over OAuth against real GitHub — broker token, askpass helper, clone. It then failed in uv sync, which is the bug fixed here.

Not verified

• options.creatable combined with options.async is undocumented. If they do not compose, the field stops accepting typed input and no non-OAuth configuration can set a repository. Needs a Ctrl+D pass before merge.
• The dependency fix has not run on the platform yet.
• listRepositories returns a truncated response against an org with ~1000 repositories; response-size cap vs sync-action timeout not yet distinguished.
• The OAuth authorization on the test project stopped working after the app was renamed and published. Most likely the app's token-expiry setting or a revoked authorization, not this code — the token is delivered correctly and rejected by GitHub.

Reviewer note

source_git.py reads larger than it is: self.git_cfg.url collapsed into one resolved self.repo_url, and the environment became a call-time overlay rather than a constructor snapshot.

🤖 Generated with Claude Code

[linear-code]

CFTL-589

[soustruh]

Review: GitHub OAuth as a third git auth method. No blockers — the token handling (askpass helper + stripping authorization from the script config) is sound and well-covered by tests. The notes below are polish.

Backward-compat: the change is additive — a new auth enum value appended, new optional fields, and one relaxed required constraint — so existing none/pat/ssh configs are unaffected.

#	Area	Sev	Location	Finding
1	Docs	Important	README.md:117	"Setting this up takes two separate steps on GitHub" is followed by three numbered items, and steps 2–3 happen in Keboola, not on GitHub. Could we make it "three steps" and mark which are on GitHub vs in Keboola?
2	Wording	Nice-to-have	tests/test_component.py:271	Docstring uses a generic verb like "surface" where a specific one reads clearer. Consider "must raise a UserException, not an internal error."
3	UI schema	Nice-to-have	component_config/configSchema.json:172	The repository dropdown has no autoload, so the user clicks "List Repositories" manually. Autoload would list on form open but also error before authorization — so a manual button is defensible. Flagging as a UX call, not a defect.
4	Robustness	Nice-to-have	src/github_api.py:61	A read timeout raises TimeoutError (subclass of OSError, not URLError), so it escapes both handlers and exits code 2. Connection timeouts are handled. Consider except OSError.
5	UI schema	Nice-to-have	component_config/configSchema.json:111	url dropped from git.required; a none/pat/ssh config can now be saved with an empty URL and fails only at run time. Safe (runtime guard catches it); flagging the lost pre-save check.
6	UI schema	Nice-to-have	component_config/configSchema.json:115	url (none/pat/ssh) and repository (oauth) are the same field — the repo clone URL — but present as two: url sits above the auth switch (propertyOrder 70, title "Repository URL"), repository below it (105, title "Repository"). Could we make them read as one field — same title ("Repository"), same tooltip, and repository ordered next to url — so only the extra "List Repositories" button marks the OAuth variant? Also consider renaming the new (unshipped) key repository → url_oauth to pair with url; url itself is a shipped key and stays.

Happy to discuss any of these.

[Oscar-XXII]

Went through all six. Current disposition — some of these moved after later changes, so this is the up-to-date view rather than what I first replied:

#	Disposition
1 Docs "two steps" / three items	Fixed. Now "three steps, in this order. Only the first one happens on GitHub." Self-inflicted — step 3 arrived in a later commit and I never revised the lead-in.
2 "surface" in a docstring	Left. It's this repo's own vocabulary, from the commit Surface invalid configuration as UserException instead of internal error.
3 No autoload on the picker	Left, deliberately. cache: false means autoload would fire on every form render, and that call currently returns a truncated response against a large org. Revisit once that's fixed.
4 Read timeout escapes the handlers	Fixed. Good catch, and above nice-to-have — listRepositories already runs near the sync-action limit. Note except OSError alone wasn't enough: TimeoutError has no reason, so the message formatting had to change too.
5 url dropped from required	Fixed, differently than I first said. The fields were later collapsed into one always-visible git.url, so it is now plainly required with minLength: 1 — no conditional validation needed. My allOf attempt in between was wrong and is gone.
6 Two names for one value	Fixed by removing the second field. git.url serves every auth method. Your naming argument was right and its conclusion turned out to be "don't have two fields at all".

Thanks for #4 and #6 in particular — both went further than the finding as written.

[soustruh]

Not doing

Bold move, @claude! 🤖

#5 — url no longer in git.required. Correct that pre-save validation was lost, and it is a deliberate trade rather than an oversight. The schema has no conditional required, and keeping url mandatory is exactly what made an OAuth configuration unsavable — the field is hidden for auth: oauth, so it demanded something the form gave no way to supply. The runtime guard catches the empty case with wording matched to each variant ("Please select a repository" vs "Git repository URL is required"), both covered by tests. Recording it here so it doesn't get re-litigated later.

Is it possible to add a check for the URL field not being empty when the correct auth value is selected? I am not sure that is even possible in the RJSF, but can you check the docs please?

#6, second half — rename repository → url_oauth. Mild preference for keeping repository, and I'll happily fold if you feel strongly, because now is the only free moment. url_oauth encodes the authentication method into a field that just holds a clone URL; if a picker is ever added for another auth method the name becomes wrong, whereas repository describes the content rather than the mechanism.

Nope, it's confusing to have the same value (repo URL) in two differently named variables, url for one auth case and repository for another. As we need to keep the existing key unchanged, url is the right direction here and can server as a prefix for the new option, which differs only by the authorization used – hence the url_oauth name. Shall we need to add another URL with another auth flow, we will change the name or use yet another variable with a proper name.

Oh, I get it now, once loaded via the sync action, the field is populated with the repo names! Too bad the URL is then saved anyway, so when users pick the repo, save the configuration and then open it again, they will see the URL instead of the pretty name, which can only be triggered by clicking the sync action button again. As for me, I'd still use url + url_oauth in the code, but maybe we can keep the visible title at Repository? @claude, please do not decide this yourself, wait for @Oscar-XXII to make the decision, thanks.

I'd also skip the reordering. Moving url changes the form for every existing configuration, and moving repository above the auth switch would ask people to pick a repository before choosing how to authenticate. The current OAuth order reads auth → repository → branch, which is the right sequence.

No, please don't skip the reordering. Currently, when users pick the repo's visibility & auth, the whole forms jumps up and down based on the option selected, that is a terrible and unfriendly UX. Yes, the current OAuth order is the right sequence, so please change the original field to that order too. Existing users will deal with that, no biggie, they probably won't be able to tell to order themselves anyway.

#2 — "surface" in the test docstring. Leaving it: it is this repo's own vocabulary, from the commit titled Surface invalid configuration as UserException instead of internal error. Changing it here would make the test read differently from the code it covers.

Yes, the repo vocabulary all drifted towards AI slop, but no problem, we will deal with that later. :-P

[Oscar-XXII]

Superseded. Claimed conditional required worked via allOf + if/then. It does not — the allOf makes the OAuth option vanish from the auth radio in RJSF. Removed in 49f6742; see the summary at the end of the thread.

[Oscar-XXII]

Superseded. Described the url_oauth / url two-field split. Both fields were later collapsed into a single git.url; see the summary at the end of the thread.

[Oscar-XXII]

Folded into the summary at the end of the thread. The durable finding: allOf inside a schema object makes RJSF drop enum values from sibling properties (rjsf-team/react-jsonschema-form#2752, #3445), so conditional validation is not usable in this UI.

[Oscar-XXII]

Summary of where this landed, since the thread above wandered.

The two-field design and the conditional-validation attempt are both gone. There is one git.url for every authentication method, below the auth switch, and the List Repositories button answers Supported only for OAuth. Please insert the URL manually. for the others. The PR description has been rewritten to match.

One durable finding worth keeping: allOf inside a schema object makes RJSF drop enum values from sibling properties (#2752, #3445). Adding an if/then that merely tests properties.auth removed the OAuth option from the radio entirely. Conditional validation is not usable here, whatever the JSON Schema standard allows. I got this wrong first because I validated the schema with the jsonschema library, which validates but does not render.

Blocking before merge: options.creatable with options.async is undocumented, and if they don't compose, no non-OAuth configuration can set a repository. That needs a Ctrl+D pass.