GitHub source authentication works differently

[rix0rrr]

In our GitHubSource, oauthToken is required, but it doesn't actually do anything.

You're supposed to authenticate the whole of CodeBuild against all of your repositories using OAuth in the console. Afterwards, you don't have to pass a token value, you just have to set auth-type to "OAUTH" and it'll work.

For reference, the following seems to work fine:

new GitHubSource({
      owner: 'rix0rrr',
      repo: 'somerepoihave',
      oauthToken: cdk.SecretValue.plainText(''),
 })

@skinny85, any clue?

[skinny85]

Perhaps it's only needed for the webhook...?

@rix0rrr , can you try the above with webhook: true, and see what happens? (i.e., is a CodeBuild build triggered by a push to the repository)

[rix0rrr]

I did this with webhook: true, fwiw

[skinny85]

And did it work? (were builds triggered by just pushing to the repository?)

[rix0rrr]

Yep. Looks like we've been thinking about this all wrong.

Before connecting to repos, you're supposed to call ImportSourceCredentials for GitHub, using a token you get from doing an OAuth browser flow or a Personal Access Token. CodeBuild will store this token somewhere on their end.

After that, you create a project and set auth.type=OAUTH, which will lead them to use the token they have stored server side.

Until CloudFormation grows support for ImportSourceCredentials or we write a custom lambda, there's no way to do this unattended.

[rix0rrr]

That means the action is to get rid of oauthToken and document this better.