RayLabsHQ/gitea-mirror
1
0
Fork 0
mirror of https://github.com/RayLabsHQ/gitea-mirror.git synced 2026-10-27 00:31:54 +01:00
Code Issues Packages Projects Releases 5 Wiki Activity

feat: GitHub App installation auth for GitHub sources (#457)

Browse Source 
Adds GitHub App installation as an authentication option for GitHub sources, with installation token refresh for Gitea 1.27+ pull mirrors, credential redaction, and the account filters applied to installation listings.
This commit is contained in:
Jeremy Williams
2026-10-20 08:38:28 +05:30
committed by GitHub
parent a9ae6047c9
commit e5b4f751b3
37 changed files with 1065 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/SOURCE_PROVIDERS.md
+6
View File
@@ -22,6 +22,12 @@ Picking GitLab or Gitea/Forgejo shows an **Instance URL** field. Leave it empty
The **Test** button on the card checks the token against the selected host.
For a GitHub source, **Authentication** can also be set to **GitHub App installation**. Create a GitHub App with repository **Contents** and **Metadata** read permissions; grant **Issues** and **Pull requests** read permissions if mirroring that metadata. Install it on the repositories to back up, enter the installation account or organization under **Username**, then enter its App ID, installation ID and PEM private key in the Sources card. The private key is encrypted at rest and is not returned by the source API. The App sees only repositories selected for its installation; it cannot discover a user's starred repositories or star lists. PAT authentication remains available for those workflows.
App installation tokens expire after an hour, so Gitea Mirror stores a fresh one on the mirror before each of its own scheduled or manual syncs and turns off Gitea's independent pull schedule for App-backed repositories. Keep the Gitea Mirror scheduler enabled for ongoing App-backed mirrors. Existing PAT mirrors continue using their usual interval.
Replacing a mirror's credentials needs Gitea 1.27 or later as the destination. Gitea 1.26 and earlier, and Forgejo, ignore those fields, so App-backed repositories are refused there with an error instead of being mirrored and failing once the first token expires. Use a personal access token for those destinations. GitHub and GitLab destinations clone with a fresh token on every push and work with any version.
## What is mirrored
The mirror itself is done by Gitea's pull mirror, which treats every source as a plain git remote. The differences are in what the source API offers.