Merge pull request #3821 from Infisical/ENG-2832

feat(dynamic-secret): Github App Tokens
2026-10-14 11:29:42 +00:00 · 2025-06-19 21:03:46 -04:00
parent ec3cbb9460 9ac4453523
commit 8329240822
19 changed files with 814 additions and 34 deletions
@@ -26,7 +26,7 @@ export const TtlFormLabel = ({ label }: { label: string }) => (
          <FontAwesomeIcon
            icon={faQuestionCircle}
            size="sm"
-            className="relative bottom-1 right-1"
+            className="relative bottom-px right-1"
          />
        </Tooltip>
      }
@@ -12,7 +12,7 @@ export type TDynamicSecret = {
  defaultTTL: string;
  status?: DynamicSecretStatus;
  statusDetails?: string;
-  maxTTL: string;
+  maxTTL?: string;
  usernameTemplate?: string | null;
  metadata?: { key: string; value: string }[];
  tags?: { key: string; value: string }[];
@@ -36,7 +36,8 @@ export enum DynamicSecretProviders {
  SapAse = "sap-ase",
  Kubernetes = "kubernetes",
  Vertica = "vertica",
-  GcpIam = "gcp-iam"
+  GcpIam = "gcp-iam",
+  Github = "github"
 }

 export enum KubernetesDynamicSecretCredentialType {
@@ -335,6 +336,14 @@ export type TDynamicSecretProvider =
      inputs: {
        serviceAccountEmail: string;
      };
+    }
+  | {
+      type: DynamicSecretProviders.Github;
+      inputs: {
+        appId: number;
+        installationId: number;
+        privateKey: string;
+      };
    };

 export type TCreateDynamicSecretDTO = {
@@ -11,7 +11,7 @@ import {
  SiSnowflake
 } from "react-icons/si";
 import { VscAzure } from "react-icons/vsc";
-import { faAws, faGoogle } from "@fortawesome/free-brands-svg-icons";
+import { faAws, faGithub, faGoogle } from "@fortawesome/free-brands-svg-icons";
 import { faClock, faDatabase } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { AnimatePresence, motion } from "framer-motion";
@@ -26,6 +26,7 @@ import { AzureEntraIdInputForm } from "./AzureEntraIdInputForm";
 import { CassandraInputForm } from "./CassandraInputForm";
 import { ElasticSearchInputForm } from "./ElasticSearchInputForm";
 import { GcpIamInputForm } from "./GcpIamInputForm";
+import { GithubInputForm } from "./GithubInputForm";
 import { KubernetesInputForm } from "./KubernetesInputForm";
 import { LdapInputForm } from "./LdapInputForm";
 import { MongoAtlasInputForm } from "./MongoAtlasInputForm";
@@ -143,6 +144,11 @@ const DYNAMIC_SECRET_LIST = [
    icon: <FontAwesomeIcon icon={faGoogle} size="lg" />,
    provider: DynamicSecretProviders.GcpIam,
    title: "GCP IAM"
+  },
+  {
+    icon: <FontAwesomeIcon icon={faGithub} size="lg" />,
+    provider: DynamicSecretProviders.Github,
+    title: "GitHub"
  }
 ];

@@ -548,6 +554,25 @@ export const CreateDynamicSecretForm = ({
                />
              </motion.div>
            )}
+          {wizardStep === WizardSteps.ProviderInputs &&
+            selectedProvider === DynamicSecretProviders.Github && (
+              <motion.div
+                key="dynamic-github-step"
+                transition={{ duration: 0.1 }}
+                initial={{ opacity: 0, translateX: 30 }}
+                animate={{ opacity: 1, translateX: 0 }}
+                exit={{ opacity: 0, translateX: -30 }}
+              >
+                <GithubInputForm
+                  onCompleted={handleFormReset}
+                  onCancel={handleFormReset}
+                  projectSlug={projectSlug}
+                  secretPath={secretPath}
+                  environments={environments}
+                  isSingleEnvironmentMode={isSingleEnvironmentMode}
+                />
+              </motion.div>
+            )}
        </AnimatePresence>
      </ModalContent>
    </Modal>
@@ -0,0 +1,234 @@
+import { Controller, useForm } from "react-hook-form";
+import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import { createNotification } from "@app/components/notifications";
+import {
+  Button,
+  FilterableSelect,
+  FormControl,
+  FormLabel,
+  Input,
+  SecretInput,
+  Tooltip
+} from "@app/components/v2";
+import { useCreateDynamicSecret } from "@app/hooks/api";
+import { DynamicSecretProviders } from "@app/hooks/api/dynamicSecret/types";
+import { WorkspaceEnv } from "@app/hooks/api/types";
+
+const formSchema = z.object({
+  provider: z.object({
+    appId: z.coerce.number().min(1, "Required"),
+    installationId: z.coerce.number().min(1, "Required"),
+    privateKey: z
+      .string()
+      .trim()
+      .min(1, "Required")
+      .refine(
+        (val) =>
+          /^-----BEGIN(?:(?: RSA| PGP| ENCRYPTED)? PRIVATE KEY)-----\s*[\s\S]*?-----END(?:(?: RSA| PGP| ENCRYPTED)? PRIVATE KEY)-----$/.test(
+            val
+          ),
+        "Invalid PEM format for private key"
+      )
+  }),
+  name: z.string().refine((val) => val.toLowerCase() === val, "Must be lowercase"),
+  environment: z.object({ name: z.string(), slug: z.string() })
+});
+type TForm = z.infer<typeof formSchema>;
+
+type Props = {
+  onCompleted: () => void;
+  onCancel: () => void;
+  secretPath: string;
+  projectSlug: string;
+  environments: WorkspaceEnv[];
+  isSingleEnvironmentMode?: boolean;
+};
+
+export const GithubInputForm = ({
+  onCompleted,
+  onCancel,
+  environments,
+  secretPath,
+  projectSlug,
+  isSingleEnvironmentMode
+}: Props) => {
+  const {
+    control,
+    formState: { isSubmitting },
+    handleSubmit
+  } = useForm<TForm>({
+    resolver: zodResolver(formSchema),
+    defaultValues: {
+      environment: isSingleEnvironmentMode && environments.length > 0 ? environments[0] : undefined
+    }
+  });
+
+  const createDynamicSecret = useCreateDynamicSecret();
+
+  const handleCreateDynamicSecret = async ({ name, provider, environment }: TForm) => {
+    if (createDynamicSecret.isPending) return;
+    try {
+      await createDynamicSecret.mutateAsync({
+        provider: {
+          type: DynamicSecretProviders.Github,
+          inputs: {
+            ...provider
+          }
+        },
+        defaultTTL: "1h", // Github is limited to 1 hour tokens
+        name,
+        path: secretPath,
+        projectSlug,
+        environmentSlug: environment.slug
+      });
+      onCompleted();
+    } catch {
+      createNotification({
+        type: "error",
+        text: "Failed to create dynamic secret"
+      });
+    }
+  };
+
+  return (
+    <div>
+      <form onSubmit={handleSubmit(handleCreateDynamicSecret)} autoComplete="off">
+        <div>
+          <div className="flex items-center space-x-2">
+            <div className="flex-grow">
+              <Controller
+                control={control}
+                defaultValue=""
+                name="name"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="Secret Name"
+                    isError={Boolean(error)}
+                    errorText={error?.message}
+                  >
+                    <Input {...field} placeholder="dynamic-secret" />
+                  </FormControl>
+                )}
+              />
+            </div>
+            <div className="w-32">
+              <FormControl
+                label={
+                  <FormLabel
+                    label="Default TTL"
+                    icon={
+                      <Tooltip content="Github token TTL is fixed to 1 hour">
+                        <FontAwesomeIcon
+                          icon={faQuestionCircle}
+                          size="sm"
+                          className="relative bottom-px right-1"
+                        />
+                      </Tooltip>
+                    }
+                  />
+                }
+              >
+                <Input disabled value="1h" className="pointer-events-none opacity-50" />
+              </FormControl>
+            </div>
+          </div>
+          <div>
+            <div className="mb-4 mt-4 border-b border-mineshaft-500 pb-2 pl-1 font-medium text-mineshaft-200">
+              Configuration
+            </div>
+
+            <div className="flex flex-col">
+              <Controller
+                control={control}
+                name="provider.appId"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="App ID"
+                    className="flex-grow"
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                    isRequired
+                  >
+                    <Input placeholder="0000000" {...field} />
+                  </FormControl>
+                )}
+              />
+
+              <Controller
+                control={control}
+                name="provider.installationId"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="Installation ID"
+                    className="flex-grow"
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                    isRequired
+                  >
+                    <Input placeholder="00000000" {...field} />
+                  </FormControl>
+                )}
+              />
+
+              <Controller
+                control={control}
+                name="provider.privateKey"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="App Private Key PEM"
+                    className="flex-grow"
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                    isRequired
+                  >
+                    <SecretInput
+                      {...field}
+                      containerClassName="text-gray-400 group-focus-within:!border-primary-400/50 border border-mineshaft-500 bg-mineshaft-900 px-2.5 py-1.5"
+                    />
+                  </FormControl>
+                )}
+              />
+            </div>
+
+            {!isSingleEnvironmentMode && (
+              <Controller
+                control={control}
+                name="environment"
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl
+                    label="Environment"
+                    isError={Boolean(error)}
+                    errorText={error?.message}
+                  >
+                    <FilterableSelect
+                      options={environments}
+                      value={value}
+                      onChange={onChange}
+                      placeholder="Select the environment to create secret in..."
+                      getOptionLabel={(option) => option.name}
+                      getOptionValue={(option) => option.slug}
+                      menuPlacement="top"
+                    />
+                  </FormControl>
+                )}
+              />
+            )}
+          </div>
+        </div>
+
+        <div className="mt-4 flex items-center space-x-4">
+          <Button type="submit" isLoading={isSubmitting}>
+            Submit
+          </Button>
+          <Button variant="outline_bg" onClick={onCancel}>
+            Cancel
+          </Button>
+        </div>
+      </form>
+    </div>
+  );
+};
@@ -368,6 +368,22 @@ const renderOutputForm = (
    );
  }

+  if (provider === DynamicSecretProviders.Github) {
+    const { TOKEN } = data as {
+      TOKEN: string;
+    };
+
+    return (
+      <div>
+        <OutputDisplay
+          label="Token"
+          value={TOKEN}
+          helperText="Important: Copy these credentials now. You will not be able to see them again after you close the modal."
+        />
+      </div>
+    );
+  }
+
  return null;
 };

@@ -608,6 +624,9 @@ export const CreateDynamicSecretLease = ({
    return <Spinner className="mx-auto h-40 text-mineshaft-700" />;
  }

+  // Github tokens are fixed to 1 hour
+  const fixedTtl = provider === DynamicSecretProviders.Github;
+
  return (
    <div>
      <AnimatePresence>
@@ -629,8 +648,11 @@ export const CreateDynamicSecretLease = ({
                    label={<TtlFormLabel label="Default TTL" />}
                    isError={Boolean(error?.message)}
                    errorText={error?.message}
+                    helperText={
+                      fixedTtl ? `This provider has a fixed TTL of ${field.value}` : undefined
+                    }
                  >
-                    <Input {...field} />
+                    <Input {...field} isDisabled={fixedTtl} />
                  </FormControl>
                )}
              />
@@ -29,7 +29,7 @@ import {
 import { ProjectPermissionDynamicSecretActions, ProjectPermissionSub } from "@app/context";
 import { usePopUp } from "@app/hooks";
 import { useGetDynamicSecretLeases, useRevokeDynamicSecretLease } from "@app/hooks/api";
-import { TDynamicSecret } from "@app/hooks/api/dynamicSecret/types";
+import { DynamicSecretProviders, TDynamicSecret } from "@app/hooks/api/dynamicSecret/types";
 import { DynamicSecretLeaseStatus } from "@app/hooks/api/dynamicSecretLease/types";

 import { RenewDynamicSecretLease } from "./RenewDynamicSecretLease";
@@ -44,6 +44,8 @@ type Props = {
  onClose: () => void;
 };

+const DYNAMIC_SECRETS_WITHOUT_RENEWAL = [DynamicSecretProviders.Github];
+
 export const DynamicSecretLease = ({
  projectSlug,
  dynamicSecretName,
@@ -94,6 +96,8 @@ export const DynamicSecretLease = ({
    }
  };

+  const canRenew = !DYNAMIC_SECRETS_WITHOUT_RENEWAL.includes(dynamicSecret.type);
+
  return (
    <div>
      <TableContainer>
@@ -141,29 +145,31 @@ export const DynamicSecretLease = ({
                </Td>
                <Td>
                  <div className="flex items-center space-x-4">
-                    <ProjectPermissionCan
-                      I={ProjectPermissionDynamicSecretActions.Lease}
-                      a={subject(ProjectPermissionSub.DynamicSecrets, {
-                        environment,
-                        secretPath,
-                        metadata: dynamicSecret.metadata
-                      })}
-                      renderTooltip
-                      allowedLabel="Renew"
-                    >
-                      {(isAllowed) => (
-                        <IconButton
-                          ariaLabel="edit-folder"
-                          variant="plain"
-                          size="sm"
-                          className="p-0"
-                          isDisabled={!isAllowed}
-                          onClick={() => handlePopUpOpen("renewSecret", { leaseId: id })}
-                        >
-                          <FontAwesomeIcon icon={faRepeat} size="lg" />
-                        </IconButton>
-                      )}
-                    </ProjectPermissionCan>
+                    {canRenew && (
+                      <ProjectPermissionCan
+                        I={ProjectPermissionDynamicSecretActions.Lease}
+                        a={subject(ProjectPermissionSub.DynamicSecrets, {
+                          environment,
+                          secretPath,
+                          metadata: dynamicSecret.metadata
+                        })}
+                        renderTooltip
+                        allowedLabel="Renew"
+                      >
+                        {(isAllowed) => (
+                          <IconButton
+                            ariaLabel="renew-lease"
+                            variant="plain"
+                            size="sm"
+                            className="p-0"
+                            isDisabled={!isAllowed}
+                            onClick={() => handlePopUpOpen("renewSecret", { leaseId: id })}
+                          >
+                            <FontAwesomeIcon icon={faRepeat} size="lg" />
+                          </IconButton>
+                        )}
+                      </ProjectPermissionCan>
+                    )}
                    <ProjectPermissionCan
                      I={ProjectPermissionDynamicSecretActions.Lease}
                      a={subject(ProjectPermissionSub.DynamicSecrets, {
@@ -10,6 +10,7 @@ import { EditDynamicSecretAzureEntraIdForm } from "./EditDynamicSecretAzureEntra
 import { EditDynamicSecretCassandraForm } from "./EditDynamicSecretCassandraForm";
 import { EditDynamicSecretElasticSearchForm } from "./EditDynamicSecretElasticSearchForm";
 import { EditDynamicSecretGcpIamForm } from "./EditDynamicSecretGcpIamForm";
+import { EditDynamicSecretGithubForm } from "./EditDynamicSecretGithubForm";
 import { EditDynamicSecretKubernetesForm } from "./EditDynamicSecretKubernetesForm";
 import { EditDynamicSecretLdapForm } from "./EditDynamicSecretLdapForm";
 import { EditDynamicSecretMongoAtlasForm } from "./EditDynamicSecretMongoAtlasForm";
@@ -366,6 +367,23 @@ export const EditDynamicSecretForm = ({
          />
        </motion.div>
      )}
+      {dynamicSecretDetails?.type === DynamicSecretProviders.Github && (
+        <motion.div
+          key="github-edit"
+          transition={{ duration: 0.1 }}
+          initial={{ opacity: 0, translateX: 30 }}
+          animate={{ opacity: 1, translateX: 0 }}
+          exit={{ opacity: 0, translateX: -30 }}
+        >
+          <EditDynamicSecretGithubForm
+            onClose={onClose}
+            projectSlug={projectSlug}
+            secretPath={secretPath}
+            dynamicSecret={dynamicSecretDetails}
+            environment={environment}
+          />
+        </motion.div>
+      )}
    </AnimatePresence>
  );
 };
@@ -0,0 +1,199 @@
+import { Controller, useForm } from "react-hook-form";
+import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import { createNotification } from "@app/components/notifications";
+import { Button, FormControl, FormLabel, Input, SecretInput, Tooltip } from "@app/components/v2";
+import { useUpdateDynamicSecret } from "@app/hooks/api";
+import { TDynamicSecret } from "@app/hooks/api/dynamicSecret/types";
+
+const formSchema = z.object({
+  inputs: z.object({
+    appId: z.coerce.number().min(1, "Required"),
+    installationId: z.coerce.number().min(1, "Required"),
+    privateKey: z
+      .string()
+      .trim()
+      .min(1, "Required")
+      .refine(
+        (val) =>
+          /^-----BEGIN(?:(?: RSA| PGP| ENCRYPTED)? PRIVATE KEY)-----\s*[\s\S]*?-----END(?:(?: RSA| PGP| ENCRYPTED)? PRIVATE KEY)-----$/.test(
+            val
+          ),
+        "Invalid PEM format for private key"
+      )
+  }),
+  newName: z.string().refine((val) => val.toLowerCase() === val, "Must be lowercase")
+});
+type TForm = z.infer<typeof formSchema>;
+
+type Props = {
+  onClose: () => void;
+  dynamicSecret: TDynamicSecret & { inputs: unknown };
+  secretPath: string;
+  environment: string;
+  projectSlug: string;
+};
+export const EditDynamicSecretGithubForm = ({
+  onClose,
+  dynamicSecret,
+  secretPath,
+  environment,
+  projectSlug
+}: Props) => {
+  const {
+    control,
+    formState: { isSubmitting },
+    handleSubmit
+  } = useForm<TForm>({
+    resolver: zodResolver(formSchema),
+    values: {
+      newName: dynamicSecret.name,
+      inputs: {
+        ...(dynamicSecret.inputs as TForm["inputs"])
+      }
+    }
+  });
+
+  const updateDynamicSecret = useUpdateDynamicSecret();
+
+  const handleUpdateDynamicSecret = async ({ inputs, newName }: TForm) => {
+    if (updateDynamicSecret.isPending) return;
+    try {
+      await updateDynamicSecret.mutateAsync({
+        name: dynamicSecret.name,
+        path: secretPath,
+        projectSlug,
+        environmentSlug: environment,
+        data: {
+          inputs,
+          newName: newName === dynamicSecret.name ? undefined : newName
+        }
+      });
+      onClose();
+      createNotification({
+        type: "success",
+        text: "Successfully updated dynamic secret"
+      });
+    } catch {
+      createNotification({
+        type: "error",
+        text: "Failed to update dynamic secret"
+      });
+    }
+  };
+
+  return (
+    <div>
+      <form onSubmit={handleSubmit(handleUpdateDynamicSecret)} autoComplete="off">
+        <div>
+          <div className="flex items-center space-x-2">
+            <div className="flex-grow">
+              <Controller
+                control={control}
+                name="newName"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="Secret Name"
+                    isError={Boolean(error)}
+                    errorText={error?.message}
+                  >
+                    <Input {...field} placeholder="dynamic-secret" />
+                  </FormControl>
+                )}
+              />
+            </div>
+            <div className="w-32">
+              <FormControl
+                label={
+                  <FormLabel
+                    label="Default TTL"
+                    icon={
+                      <Tooltip content="Github token TTL is fixed to 1 hour">
+                        <FontAwesomeIcon
+                          icon={faQuestionCircle}
+                          size="sm"
+                          className="relative bottom-px right-1"
+                        />
+                      </Tooltip>
+                    }
+                  />
+                }
+              >
+                <Input disabled value="1h" className="pointer-events-none opacity-50" />
+              </FormControl>
+            </div>
+          </div>
+          <div>
+            <div className="mb-4 mt-4 border-b border-mineshaft-500 pb-2 pl-1 font-medium text-mineshaft-200">
+              Configuration
+            </div>
+
+            <div className="flex flex-col">
+              <Controller
+                control={control}
+                name="inputs.appId"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="App ID"
+                    className="flex-grow"
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                    isRequired
+                  >
+                    <Input placeholder="0000000" {...field} />
+                  </FormControl>
+                )}
+              />
+
+              <Controller
+                control={control}
+                name="inputs.installationId"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="Installation ID"
+                    className="flex-grow"
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                    isRequired
+                  >
+                    <Input placeholder="00000000" {...field} />
+                  </FormControl>
+                )}
+              />
+
+              <Controller
+                control={control}
+                name="inputs.privateKey"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="App Private Key PEM"
+                    className="flex-grow"
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                    isRequired
+                  >
+                    <SecretInput
+                      {...field}
+                      containerClassName="text-gray-400 group-focus-within:!border-primary-400/50 border border-mineshaft-500 bg-mineshaft-900 px-2.5 py-1.5"
+                    />
+                  </FormControl>
+                )}
+              />
+            </div>
+          </div>
+        </div>
+        <div className="mt-4 flex items-center space-x-4">
+          <Button type="submit" isLoading={isSubmitting}>
+            Submit
+          </Button>
+          <Button variant="outline_bg" onClick={onClose}>
+            Cancel
+          </Button>
+        </div>
+      </form>
+    </div>
+  );
+};
@@ -28,7 +28,7 @@ export const RenewDynamicSecretLease = ({
  environment,
  dynamicSecret
 }: Props) => {
-  const maxTtlMs = ms(dynamicSecret.maxTTL);
+  const maxTtlMs = dynamicSecret.maxTTL ? ms(dynamicSecret.maxTTL) : undefined;

  const formSchema = z.object({
    ttl: z.string().superRefine((val, ctx) => {
@@ -39,7 +39,7 @@ export const RenewDynamicSecretLease = ({
          code: z.ZodIssueCode.custom,
          message: "TTL must be greater than 1 second"
        });
-      if (valMs > maxTtlMs)
+      if (maxTtlMs && valMs > maxTtlMs)
        ctx.addIssue({
          code: z.ZodIssueCode.custom,
          message: `TTL must be less than ${dynamicSecret.maxTTL}`