gitops 1.7.1__tar.gz → 1.9.0__tar.gz

{gitops-1.7.1 → gitops-1.9.0}/.github/workflows/test.yml

@@ -36,6 +36,12 @@ jobs:
           cache: true
           experimental: true
 
+      # Secrets in the cluster repo are git-crypt encrypted, and the app
+      # definition loader decrypts them. Without this the coverage of that path
+      # silently skips.
+      - name: Install git-crypt
+        run: sudo apt-get update && sudo apt-get install -y git-crypt
+
       - name: Run CI
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

gitops-1.9.0/.release-please-manifest.json

@@ -0,0 +1,5 @@
+{
+    ".": "1.9.0",
+    "gitops_server": "0.15.1",
+    "charts/gitops": "1.3.0"
+}

{gitops-1.7.1 → gitops-1.9.0}/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## [1.9.0](https://github.com/uptick/gitops/compare/gitops-v1.8.0...gitops-v1.9.0) (2026-09-09)
+
+
+### Features
+
+* authenticate to GitHub as an App ([51ae678](https://github.com/uptick/gitops/commit/51ae678a874cf205b0f612404426c7444611f96c))
+
+
+### Bug Fixes
+
+* authenticate the repo-cache fetch, and tighten the mint ([3c1100b](https://github.com/uptick/gitops/commit/3c1100b936a3fb83eef28d3ed2732d0afaf8d607))
+* scope the credential helper to github.com ([7068133](https://github.com/uptick/gitops/commit/7068133b1a3796ffa85de191549097d2ad724f6d))
+
+
+### Documentation
+
+* cut comments back to what is not derivable from the code ([4d41784](https://github.com/uptick/gitops/commit/4d4178478da4efa37b924e3cab3da430e8ec68bd))
+
+## [1.8.0](https://github.com/uptick/gitops/compare/gitops-v1.7.1...gitops-v1.8.0) (2026-08-21)
+
+
+### Features
+
+* **worker:** bound concurrent deployments ([956c630](https://github.com/uptick/gitops/commit/956c6309516ba831805aa1df90fd4fdb7314cb43))
+
+
+### Bug Fixes
+
+* **security:** stop embedding the github token in clone URLs ([fd88bc1](https://github.com/uptick/gitops/commit/fd88bc1176a51caf9dddca37aee9d4ecfc0b5c78))
+* **security:** stop embedding the github token in clone URLs ([68b7225](https://github.com/uptick/gitops/commit/68b722547d83e2ab1560ef7af0bc925d893b7580))
+
+
+### Performance Improvements
+
+* **deploy:** read app definitions from git instead of checking out the repo ([0b21790](https://github.com/uptick/gitops/commit/0b2179084e8920790de70363cdb369558342e895))
+* **deploy:** read app definitions from git instead of checking out the repo ([f90bc3a](https://github.com/uptick/gitops/commit/f90bc3a60141423313574813adeb1313406f7168))
+
 ## [1.7.1](https://github.com/uptick/gitops/compare/gitops-v1.7.0...gitops-v1.7.1) (2026-08-17)
 
 

{gitops-1.7.1 → gitops-1.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gitops
-Version: 1.7.1
+Version: 1.9.0
 Summary: Manage multiple apps across one or more k8s clusters.
 Author-email: Jarek Głowacki <jarekwg@gmail.com>
 License-File: LICENSE
@@ -22,6 +22,7 @@ Requires-Dist: httpx>=0.27.0; extra == 'server'
 Requires-Dist: idna>=3.15; extra == 'server'
 Requires-Dist: kubernetes-asyncio>=25.1.2; extra == 'server'
 Requires-Dist: protobuf>=5.29.6; extra == 'server'
+Requires-Dist: pyjwt[crypto]>=2.10.0; extra == 'server'
 Requires-Dist: requests>=2.33.0; extra == 'server'
 Requires-Dist: sentry-sdk>=1.3.0; extra == 'server'
 Requires-Dist: slack-sdk>=3.33.5; extra == 'server'

{gitops-1.7.1 → gitops-1.9.0}/charts/gitops/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [1.3.0](https://github.com/uptick/gitops/compare/helm-v1.2.2...helm-v1.3.0) (2026-09-09)
+
+
+### Features
+
+* authenticate to GitHub as an App ([51ae678](https://github.com/uptick/gitops/commit/51ae678a874cf205b0f612404426c7444611f96c))
+
+
+### Bug Fixes
+
+* authenticate the repo-cache fetch, and tighten the mint ([3c1100b](https://github.com/uptick/gitops/commit/3c1100b936a3fb83eef28d3ed2732d0afaf8d607))
+* scope the credential helper to github.com ([7068133](https://github.com/uptick/gitops/commit/7068133b1a3796ffa85de191549097d2ad724f6d))
+
 ## [1.2.2](https://github.com/uptick/gitops/compare/helm-v1.2.1...helm-v1.2.2) (2026-05-28)
 
 

{gitops-1.7.1 → gitops-1.9.0}/charts/gitops/Chart.yaml

@@ -2,4 +2,4 @@ apiVersion: v1
 appVersion: "1.0"
 description: GitOps Server Helm chart.
 name: gitops
-version: 1.2.2
+version: 1.3.0

{gitops-1.7.1 → gitops-1.9.0}/charts/gitops/templates/deployment.yml

@@ -65,6 +65,11 @@ spec:
               secretKeyRef:
                 name: {{ .Release.Name }}-secret
                 key: GITHUB_OAUTH_TOKEN
+          - name: GITHUB_APP_PRIVATE_KEY
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Release.Name }}-secret
+                key: GITHUB_APP_PRIVATE_KEY
           - name: GITHUB_WEBHOOK_KEY
             valueFrom:
               secretKeyRef:

{gitops-1.7.1 → gitops-1.9.0}/charts/gitops/templates/secrets.yml

@@ -10,4 +10,5 @@ stringData:
   SENTRY_DSN: {{ .Values.secrets.SENTRY_DSN| quote}}
   SLACK_TOKEN: {{ .Values.secrets.SLACK_TOKEN| quote}}
 data:
-  GIT_CRYPT_KEY: {{ .Values.secrets.GIT_CRYPT_KEY | quote}}
+  GIT_CRYPT_KEY: {{ .Values.secrets.GIT_CRYPT_KEY | quote}}
+  GITHUB_APP_PRIVATE_KEY: {{ .Values.secrets.GITHUB_APP_PRIVATE_KEY | quote}}

{gitops-1.7.1 → gitops-1.9.0}/charts/gitops/values.yaml

@@ -9,11 +9,16 @@ environment:
   TZ: "UTC"
   # The channel id to send slack messages to
   SLACK_CHANNEL_ID: ""
+  # GitHub App identifiers. Empty when authenticating with a PAT.
+  GITHUB_APP_ID: ""
+  GITHUB_INSTALLATION_ID: ""
 
 secrets:
   ACCOUNT_ID: ""
   SLACK_TOKEN: ""
   GITHUB_OAUTH_TOKEN: ""
+  # base64-encoded PEM. Empty when authenticating with a PAT.
+  GITHUB_APP_PRIVATE_KEY: ""
   GITHUB_WEBHOOK_KEY: ""
   GIT_CRYPT_KEY: ""
   SENTRY_DSN: ""

{gitops-1.7.1 → gitops-1.9.0}/gitops/__init__.py

@@ -6,7 +6,7 @@ from gitops.utils.apps import App, get_app_details, get_apps  # type: ignore[att
 
 from .utils.cli import success, warning
 
-__version__ = "1.7.1"
+__version__ = "1.9.0"
 
 
 # Checking gitops version matches cluster repo version.

{gitops-1.7.1 → gitops-1.9.0}/gitops_server/app.py

@@ -1,4 +1,5 @@
 import asyncio
+import logging
 import os
 from collections.abc import AsyncIterator
 from contextlib import asynccontextmanager
@@ -9,12 +10,19 @@ from sentry_sdk.integrations.asgi import SentryAsgiMiddleware
 
 from . import settings
 
+logger = logging.getLogger("gitops")
+
 
 @asynccontextmanager
 async def lifespan(app: FastAPI) -> AsyncIterator[None]:
     """Manage application lifespan - start and stop background workers."""
+    from .utils.github_auth import credentials, validate_credentials
     from .workers import DeployQueueWorker
 
+    # Fail here rather than on the first push, where hooks.py only logs a warning.
+    validate_credentials()
+    logger.info("GitHub authentication: %s", credentials.describe())
+
     loop = asyncio.get_running_loop()
     deploy_queue_worker = DeployQueueWorker.get_worker()
     deploy_queue_worker_task = asyncio.ensure_future(deploy_queue_worker.run(), loop=loop)

{gitops-1.7.1 → gitops-1.9.0}/gitops_server/settings.py

@@ -16,3 +16,8 @@ SLACK_ALERT_CHANNEL_ID = os.environ.get("SLACK_ALERT_CHANNEL_ID", "")
 
 # How many parallel deploys can be done at once
 GITOPS_MAX_PARALLEL_DEPLOYS = os.environ.get("GITOPS_MAX_PARALLEL_DEPLOYS", "5")
+
+# How many pushes can be processed at once. Each one loads app definitions for
+# two commits before it reaches GITOPS_MAX_PARALLEL_DEPLOYS, so without a bound
+# here a burst of pushes is only limited by how fast they arrive.
+GITOPS_MAX_CONCURRENT_DEPLOYMENTS = os.environ.get("GITOPS_MAX_CONCURRENT_DEPLOYMENTS", "20")

{gitops-1.7.1 → gitops-1.9.0}/gitops_server/utils/__init__.py

@@ -1,5 +1,6 @@
 import asyncio
 import logging
+import os
 from collections.abc import Callable
 from pathlib import Path
 
@@ -19,16 +20,28 @@ async def _read_stream(stream: asyncio.StreamReader | None, cb: Callable[[bytes]
             break
 
 
-async def run(command: str, suppress_errors: bool = False, cwd: str | Path | None = None) -> RunOutput:
+async def run(
+    command: str,
+    suppress_errors: bool = False,
+    cwd: str | Path | None = None,
+    env: dict[str, str] | None = None,
+) -> RunOutput:
     """Run a shell command.
 
     Runs the command in an asyncio executor to keep things async. Will
     optionally prevent raising an exception on failure with `suppress_errors`.
+
+    `env` is overlaid on the current environment, so a caller can hand one command
+    a credential without putting it in argv.
     """
     exit_code = 0
     logger.info(f'Running "{command}".')
     proc = await asyncio.create_subprocess_shell(
-        command, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE, cwd=cwd
+        command,
+        stdout=asyncio.subprocess.PIPE,
+        stderr=asyncio.subprocess.PIPE,
+        cwd=cwd,
+        env={**os.environ, **env} if env else None,
     )
     stdout, stderr = b"", b""
 

gitops-1.9.0/gitops_server/utils/git.py

@@ -0,0 +1,197 @@
+import asyncio
+import logging
+import os
+import re
+import tempfile
+from collections.abc import AsyncGenerator
+from contextlib import asynccontextmanager
+from pathlib import Path
+
+from opentelemetry.trace import get_tracer
+
+from . import run
+from .github_auth import credentials
+
+tracer = get_tracer(__name__)
+logger = logging.getLogger("gitops")
+
+REPO_CACHE_DIR = Path("/tmp/gitops/repocache")
+REPO_CACHE: dict[str, Path] = {}
+repo_lock = asyncio.Semaphore(1)
+
+# git-crypt prefixes every encrypted blob with this magic.
+GIT_CRYPT_MAGIC = b"\0GITCRYPT\0"
+
+# git-crypt has no batch mode: one process per file. Bounded so concurrent
+# loads can't fork-storm.
+decrypt_semaphore = asyncio.Semaphore(16)
+
+
+async def credential_env(git_repo_url: str) -> dict[str, str] | None:
+    """Credentials for a git subprocess, or None for a remote that needs none.
+
+    Local paths in tests are not GitHub, and asking would mint a token for nothing.
+    """
+    if "://" not in git_repo_url:
+        return None
+    return await credentials.git_env()
+
+
+async def clone_repo(git_repo_url: str, path: str, sha: str | None = None, branch: str | None = None) -> None:
+    """Shallow Clones a git repo url to path and git-crypt unlocks all encrypted files"""
+    logger.info(f'Cloning "{git_repo_url}".')
+
+    env = await credential_env(git_repo_url)
+
+    with tracer.start_as_current_span("tempo_repo.clone_repo"):
+        if sha:
+            await run(f"git clone --depth 100 {git_repo_url} {path}; cd {path}; git checkout {sha}", env=env)
+        elif branch:
+            await run(f"git clone --depth 1 {git_repo_url} {path} --branch {branch}", env=env)
+        else:
+            await run(f"git clone --depth 100 {git_repo_url} {path};", env=env)
+
+    if GIT_CRYPT_KEY_FILE := os.environ.get("GIT_CRYPT_KEY_FILE"):
+        with tracer.start_as_current_span("temp_repo.git_crypt_unlock"):
+            await run(f"cd {path}; git-crypt unlock {GIT_CRYPT_KEY_FILE}")
+
+
+def is_sha(sha_or_ref: str | None) -> bool:
+    """Check if the given string is a valid SHA-1 hash or a short SHA."""
+    if not sha_or_ref:
+        return False
+    return bool(re.fullmatch(r"[a-fA-F0-9]{4,40}", sha_or_ref))
+
+
+@asynccontextmanager
+async def temp_repo(git_repo_url: str, ref: str | None) -> AsyncGenerator[str, None]:
+    """Checks out a git_repo_url to a temporary folder location. Returns temporary folder location"""
+    # Someone passed us a branch name, not a sha
+
+    if not is_sha(ref):
+        async with temp_repo_branch(git_repo_url, branch=ref) as temp_repo_path:
+            yield temp_repo_path
+            return
+
+    assert ref is not None  # is_sha() returns False for None
+    with tracer.start_as_current_span("checkout_temp_repo"):
+        cache_path = await ensure_repo_cache(git_repo_url, ref)
+
+        # Copy the repo cache to a temporary folder
+        with tempfile.TemporaryDirectory() as temporary_folder_path:
+            await run(f"rm -rf {temporary_folder_path}", suppress_errors=True)
+            await run(f"cp -r {cache_path} {temporary_folder_path}")
+            # ref is already in the cache, so no per-copy fetch.
+            await run(f"cd {temporary_folder_path};git checkout {ref}")
+
+            yield temporary_folder_path
+
+
+async def _git(repo: str, *args: str, stdin: bytes | None = None, env: dict[str, str] | None = None) -> bytes:
+    """Run git in `repo`, returning raw stdout.
+
+    Not `run()`: blobs are binary, and `run()` decodes and logs every line.
+    """
+    proc = await asyncio.create_subprocess_exec(
+        "git",
+        "-C",
+        repo,
+        *args,
+        stdin=asyncio.subprocess.PIPE if stdin is not None else None,
+        stdout=asyncio.subprocess.PIPE,
+        stderr=asyncio.subprocess.PIPE,
+        env={**os.environ, **env} if env else None,
+    )
+    stdout, stderr = await proc.communicate(stdin)
+    if proc.returncode != 0:
+        raise Exception(f"git {' '.join(args)} failed in {repo}: {stderr.decode(errors='replace')}")
+    return stdout
+
+
+async def ensure_repo_cache(git_repo_url: str, ref: str) -> str:
+    """Clone the shared cache if absent and ensure `ref` is in it."""
+    cache_path = REPO_CACHE_DIR / git_repo_url.split("/")[-1].split(".")[0]
+    async with repo_lock:
+        if not (cache_path / ".git").exists():
+            logger.info("Repo %s not in cache, cloning", git_repo_url)
+            if cache_path.exists():
+                await run(f"rm -rf {cache_path}", suppress_errors=True)
+            cache_path.mkdir(parents=True)
+            REPO_CACHE[git_repo_url] = cache_path
+            await clone_repo(git_repo_url, path=str(cache_path))
+
+        try:
+            await _git(str(cache_path), "cat-file", "-e", f"{ref}^{{commit}}")
+        except Exception:
+            logger.info("Ref %s not in cache, fetching", ref)
+            env = await credential_env(git_repo_url)
+            await _git(str(cache_path), "fetch", "--quiet", "origin", env=env)
+    return str(cache_path)
+
+
+async def list_tree_blobs(repo: str, sha: str, prefix: str) -> dict[str, str]:
+    """Map path -> blob oid for every file under `prefix` at `sha`."""
+    out = await _git(repo, "ls-tree", "-r", sha, "--", prefix)
+    blobs: dict[str, str] = {}
+    for line in out.decode().splitlines():
+        meta, _, path = line.partition("\t")
+        parts = meta.split()
+        if len(parts) == 3 and parts[1] == "blob":
+            blobs[path] = parts[2]
+    return blobs
+
+
+async def read_blobs(repo: str, oids: list[str]) -> dict[str, bytes]:
+    """Read many blobs in a single `git cat-file --batch` process."""
+    if not oids:
+        return {}
+    out = await _git(repo, "cat-file", "--batch", stdin=("\n".join(oids) + "\n").encode())
+
+    contents: dict[str, bytes] = {}
+    pos = 0
+    while pos < len(out):
+        eol = out.find(b"\n", pos)
+        if eol == -1:
+            break
+        header = out[pos:eol].decode()
+        pos = eol + 1
+        parts = header.split()
+        if len(parts) != 3:
+            # "<oid> missing" — nothing to consume for this entry.
+            continue
+        oid, _, size = parts[0], parts[1], int(parts[2])
+        contents[oid] = out[pos : pos + size]
+        pos += size + 1  # trailing newline
+    return contents
+
+
+async def decrypt_blob(repo: str, content: bytes) -> bytes:
+    """Decrypt a git-crypt blob; unencrypted content passes through.
+
+    Reading a blob bypasses the smudge filter, so apply it explicitly.
+    """
+    if not content.startswith(GIT_CRYPT_MAGIC):
+        return content
+    async with decrypt_semaphore:
+        proc = await asyncio.create_subprocess_exec(
+            "git-crypt",
+            "smudge",
+            cwd=repo,
+            stdin=asyncio.subprocess.PIPE,
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+        )
+        stdout, stderr = await proc.communicate(content)
+    if proc.returncode != 0:
+        raise Exception(f"git-crypt smudge failed in {repo}: {stderr.decode(errors='replace')}")
+    return stdout
+
+
+@asynccontextmanager
+async def temp_repo_branch(git_repo_url: str, branch: str | None) -> AsyncGenerator[str, None]:
+    """Checks out a git_repo_url to a temporary folder location. Returns temporary folder location"""
+    with tracer.start_as_current_span("checkout_temp_repo_branch"):
+        # Copy the repo cache to a temporary folder
+        with tempfile.TemporaryDirectory() as temporary_folder_path:
+            await clone_repo(git_repo_url, path=str(temporary_folder_path), branch=branch)
+            yield temporary_folder_path

{gitops-1.7.1 → gitops-1.9.0}/gitops_server/utils/github.py

@@ -1,11 +1,10 @@
 import logging
-import os
 
 import httpx
 
-logger = logging.getLogger("github")
+from gitops_server.utils.github_auth import credentials
 
-GITHUB_OAUTH_TOKEN = os.environ.get("GITHUB_OAUTH_TOKEN")
+logger = logging.getLogger("github")
 
 
 class IssueNotFound(Exception): ...
@@ -19,10 +18,9 @@ class STATUSES:
     error = "error"  # when error during helm deploy
 
 
-def get_headers() -> dict[str, str]:
+async def get_headers() -> dict[str, str]:
     return {
-        "Authorization": f"token {GITHUB_OAUTH_TOKEN}",
-        "Content-Type": "application/json",
+        **await credentials.headers(),
         "Accept": ("application/vnd.github.flash-preview+json, application/vnd.github.ant-man-preview+json"),
     }
 
@@ -43,7 +41,7 @@ async def update_deployment(deployment_url: str, status: str, description: str,
         response = await client.post(
             status_url,
             json=data,
-            headers=get_headers(),
+            headers=await get_headers(),
         )
         if response.status_code >= 300 and response.status_code != 404:
             try:

gitops-1.9.0/gitops_server/utils/github_auth.py

@@ -0,0 +1,133 @@
+"""GitHub credentials: a PAT in GITHUB_OAUTH_TOKEN when set, otherwise an App
+installation token minted from the private key and cached until near expiry.
+"""
+
+import asyncio
+import logging
+import os
+import time
+from datetime import datetime
+
+import httpx
+import jwt
+
+logger = logging.getLogger("github_auth")
+
+GITHUB_API = "https://api.github.com"
+# Refresh with this much left, so a slow deploy never loses its token mid-flight.
+MIN_REMAINING_SECONDS = 30 * 60
+# GitHub rejects an App JWT that lives longer than this.
+APP_JWT_TTL_SECONDS = 10 * 60
+GIT_CREDENTIAL_ENV_VAR = "GITHUB_OAUTH_TOKEN"
+
+# The credential helper travels with the token rather than living in the image, so
+# it cannot drift from the code that supplies it. Scoped to github.com: an unscoped
+# helper answers for every host git reaches, including across a redirect.
+_CREDENTIAL_HELPER = f'!f() {{ printf "username=x-access-token\\npassword=%s\\n" "${GIT_CREDENTIAL_ENV_VAR}"; }}; f'
+_HELPER_CONFIG = {
+    "GIT_CONFIG_COUNT": "2",
+    # An empty value resets the helper list. Without it git keeps whatever helper the
+    # environment already configures -- macOS ships credential.helper=osxkeychain in
+    # the Command Line Tools gitconfig -- and takes that answer instead of ours.
+    "GIT_CONFIG_KEY_0": "credential.helper",
+    "GIT_CONFIG_VALUE_0": "",
+    "GIT_CONFIG_KEY_1": "credential.https://github.com.helper",
+    "GIT_CONFIG_VALUE_1": _CREDENTIAL_HELPER,
+}
+
+
+class GitHubCredentials:
+    """Supplies a token for API calls and git clones, refreshing as needed.
+
+    Reads the environment on use, not at import, so a deployment can be swapped
+    between the PAT and the App without a code change or a restart.
+    """
+
+    def __init__(self) -> None:
+        self._token: str | None = None
+        self._expires_at: float = 0.0
+        # Without this two callers both find the cache stale and both mint.
+        self._lock = asyncio.Lock()
+
+    @property
+    def uses_app(self) -> bool:
+        return not os.environ.get("GITHUB_OAUTH_TOKEN", "").strip()
+
+    def describe(self) -> str:
+        if not self.uses_app:
+            return "GITHUB_OAUTH_TOKEN (personal access token)"
+        return (
+            f"GitHub App {os.environ.get('GITHUB_APP_ID', '')} "
+            f"installation {os.environ.get('GITHUB_INSTALLATION_ID', '')}"
+        )
+
+    def _app_jwt(self) -> str:
+        now = int(time.time())
+        return jwt.encode(
+            {"iat": now - 60, "exp": now + APP_JWT_TTL_SECONDS, "iss": os.environ.get("GITHUB_APP_ID", "")},
+            os.environ.get("GITHUB_APP_PRIVATE_KEY", ""),
+            algorithm="RS256",
+        )
+
+    def _is_fresh(self) -> bool:
+        return bool(self._token) and time.time() < (self._expires_at - MIN_REMAINING_SECONDS)
+
+    async def token(self) -> str:
+        if not self.uses_app:
+            return os.environ["GITHUB_OAUTH_TOKEN"].strip()
+        if self._is_fresh():
+            assert self._token is not None
+            return self._token
+
+        async with self._lock:
+            # Another caller may have minted while we waited.
+            if self._is_fresh():
+                assert self._token is not None
+                return self._token
+
+            async with httpx.AsyncClient(timeout=30.0) as client:
+                response = await client.post(
+                    f"{GITHUB_API}/app/installations/{os.environ.get('GITHUB_INSTALLATION_ID', '')}/access_tokens",
+                    headers={
+                        "Authorization": f"Bearer {self._app_jwt()}",
+                        "Accept": "application/vnd.github+json",
+                    },
+                )
+                response.raise_for_status()
+                data = response.json()
+
+            token = str(data["token"])
+            self._token = token
+            self._expires_at = datetime.fromisoformat(data["expires_at"].replace("Z", "+00:00")).timestamp()
+            logger.info("GitHub installation token refreshed, expires at %s", data["expires_at"])
+            return token
+
+    async def headers(self) -> dict[str, str]:
+        return {
+            "Authorization": f"Bearer {await self.token()}",
+            "Content-Type": "application/json",
+        }
+
+    async def git_env(self) -> dict[str, str]:
+        """Minted per command, so a long-lived process never pins an expiring token."""
+        return {GIT_CREDENTIAL_ENV_VAR: await self.token(), **_HELPER_CONFIG}
+
+
+def validate_credentials() -> None:
+    if os.environ.get("GITHUB_OAUTH_TOKEN", "").strip():
+        return
+    required = ("GITHUB_APP_ID", "GITHUB_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY")
+    if missing := [name for name in required if not os.environ.get(name)]:
+        raise RuntimeError(
+            "No GitHub credential configured: set GITHUB_OAUTH_TOKEN, or all of "
+            f"{', '.join(required)} (missing: {', '.join(missing)})"
+        )
+    # Signing parses the key, so an unusable one fails here rather than on the
+    # first deploy. A revoked key or a wrong id still only surfaces on first use.
+    try:
+        credentials._app_jwt()
+    except Exception as exc:
+        raise RuntimeError(f"GITHUB_APP_PRIVATE_KEY cannot sign a JWT: {exc}") from exc
+
+
+credentials = GitHubCredentials()

gitops-1.9.0/gitops_server/version.py

@@ -0,0 +1 @@
+__version__ = "1.9.0"