feat(terragrunt): add GitHub authentication support #7359
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Added support for GitHub token authentication when accessing private repositories during autodiscovery. Implementation: - New 'github.token' configuration option in Spec - Auto-detection from UPDATECLI_GITHUB_TOKEN or GITHUB_TOKEN env vars - Uses official github/token package for token resolution - Injects authentication into generated SCM configurations Token precedence (highest to lowest): 1. Spec configuration (github.token) 2. UPDATECLI_GITHUB_TOKEN environment variable 3. GITHUB_TOKEN environment variable Added comprehensive tests for token precedence logic. This brings terragrunt autodiscovery in line with other plugins (githubaction, etc.) for handling private repository access.
Member
|
Thanks for the pull request, this is an issue that I noticed while working on #7238 |
olblak
reviewed
Jan 1, 2026
olblak
reviewed
Jan 1, 2026
Contributor
Author
|
I've refactored the implementation based on your feedback |
olblak
approved these changes
Jan 2, 2026
Member
|
Thanks for the pull request, I am planning to push a new release early next week |
eugenestarchenko
added a commit
to eugenestarchenko/updatecli
that referenced
this pull request
Jan 12, 2026
Fix token-only authentication by providing username default for go-git. PR updatecli#7359 added token support but token-only auth fails because go-git requires non-empty username for HTTP BasicAuth. This fix adds: - Username *string field to Spec with oauth2 default - getUsername() method matching GitHub SCM plugin behavior - Updated manifest template to include username field - Test coverage for getUsername() Fixes token authentication added in updatecli#7359
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
Terragrunt autodiscovery had no support for authenticating to private GitHub repositories. While other autodiscovery plugins (githubaction, etc.) support GitHub tokens, terragrunt plugin would fail when encountering private repos.
Solution
Added generic authentication support that works with any Git provider:
Configuration
Token Resolution
Token must be explicitly set for private repositories. No auto-detection.
Template functions can be used to read from environment:
token: "{{ requiredEnv "GITHUB_TOKEN" }}"
token: "{{ requiredEnv "GITLAB_TOKEN" }}"
Implementation
Testing
Added TestGetToken with test coverage for: