Add GitHub App authentication for git DAG bundles by RaphCodec · Pull Request #64422 · apache/airflow

RaphCodec · 2026-03-29T19:47:40Z

Purpose

Adding GitHub App Authentication to the Git Provider. This feature is intended to be a security benefit for those who want to use GitHub Dag Bundles in Airflow 3, but for whatever reason cannot use a SSH deploy key to authenticate to GitHub and would prefer not to use their own PAT.

In case of an existing issue, reference it using one of the following:

closes: Git Provider GitHub App Authentication #62478

Was generative AI tooling used to co-author this PR?

Yes - Claude Sonnet 4.6

Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
When adding dependency, check compliance with the ASF 3rd Party License Policy.
For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

Important

🛠️ Maintainer triage note for @RaphCodec · by @potiuk · 2026-07-08 15:38 UTC

Helpful heads-up from the maintainers — please address before this PR can be reviewed:

Other failing CI checks failing (Build info, Platform: AMD, Migration round-trip check (+2 more)). See the contributor guide.
Unit tests failing (Go SDK tests, Java SDK tests). See the contributor guide.
Build docs failing (Java SDK docs). See the contributor guide.
Provider tests failing (MyPy providers checks). See the contributor guide.

Full criteria: Pull Request quality criteria.

The ball is in your court — you've been assigned to this PR. Fix the above, then mark it Ready for review.

_{Automated triage — may be imperfect; a maintainer takes the next look.}

boring-cyborg · 2026-03-29T19:47:43Z

Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide (https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:

Pay attention to the quality of your code (ruff, mypy and type annotations). Our prek-hooks will help you with that.
In case of a new feature add useful documentation (in docstrings or in docs/ directory). Adding a new operator? Check this short guide Consider adding an example DAG that shows how users should use it.
Consider using Breeze environment for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
Be sure to read the Airflow Coding style.
Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
Apache Airflow is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@airflow.apache.org
Slack: https://s.apache.org/airflow-slack

potiuk · 2026-04-01T19:04:44Z

@RaphCodec Converting to draft — this PR doesn't yet meet our Pull Request quality criteria.

❌ Merge conflicts: This PR has merge conflicts with the main branch. Your branch is 90 commits behind main. Please rebase your branch (git fetch origin && git rebase origin/main), resolve the conflicts, and push again. See contributing quick start.

Note: Your branch is 90 commits behind main. Please rebase and push again to get up-to-date CI results.

See the linked criteria for how to fix each item, then mark the PR "Ready for review". This is not a rejection — just an invitation to bring the PR up to standard. No rush.

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. Once you have addressed the points above, an Apache Airflow maintainer — a real person — will take the next look at your PR. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

Copilot

Pull request overview

Adds GitHub App-based authentication support to the Git provider’s GitHook so Git-backed DagBundles can authenticate to GitHub without SSH deploy keys (using an installation access token instead).

Changes:

Extend GitHook connection extras/UI placeholders to accept GitHub App identifiers and generate an installation token for HTTPS cloning.
Add an optional dependency extra for GitHub App support (pygithub / PyGithub) in the git provider.
Update the workspace lockfile to include the new optional extra and reflect a refreshed dependency resolution.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 6 comments.

File	Description
`providers/git/src/airflow/providers/git/hooks/git.py`	Adds GitHub App auth fields and token generation logic to rewrite HTTPS repo URLs with an installation token.
`providers/git/pyproject.toml`	Introduces an optional dependency extra for GitHub App support.
`uv.lock`	Updates the lockfile to include the new optional extra and updated resolved packages.

Copilot

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

RaphCodec · 2026-04-19T16:39:24Z

Thanks for the feedback. I went over the code more thourghly, improved it and updated the branch. I will try to update the branch at least once a day to prevent merge conflicts.

potiuk · 2026-04-27T23:20:12Z

@RaphCodec Converting to draft — this PR doesn't yet meet our Pull Request quality criteria.

❌ Merge conflicts: This PR has merge conflicts with main. GitHub's "Update branch" button cannot resolve them — please rebase locally and resolve the conflicts manually:
```
git fetch upstream main
git rebase upstream/main
# resolve conflicts, then:
git push --force-with-lease
```
❌ Failing CI checks: Failing: Build info. This is most likely a downstream effect of the merge conflicts above — once the rebase is clean, please re-trigger CI by pushing the rebased branch.

See the linked criteria for how to fix each item, then mark the PR "Ready for review". This is not a rejection — just an invitation to bring the PR up to standard. No rush.

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. Once you have addressed the points above, an Apache Airflow maintainer — a real person — will take the next look at your PR. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

RaphCodec · 2026-06-06T18:01:11Z

@potiuk I made the requested changes and address issues 1-9.

jscheffl

I am not an expert of GH App Auth, so I can just skim over the code. Does not look bad but I can not really judge. Some other maintainer around who known more?

RaphCodec · 2026-06-28T14:17:43Z

@potiuk I checked the failing provider distribution tests and they seem to be unrelated to the changes in my PR. The failing tests (https://github.com/RaphCodec/airflow/actions/runs/28319050045/job/83900082499) failed due to issues with the amazon and azure providers.

Example Error:

================================================================================================= ERRORS =================================================================================================
_______________________________________________________ ERROR collecting providers/microsoft/azure/tests/unit/microsoft/azure/hooks/test_batch.py ________________________________________________________
ImportError while importing test module '/opt/airflow/providers/microsoft/azure/tests/unit/microsoft/azure/hooks/test_batch.py'.
Hint: make sure your test modules/packages have valid Python names.
Traceback:
/usr/python/lib/python3.10/importlib/__init__.py:126: in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
providers/microsoft/azure/tests/unit/microsoft/azure/hooks/test_batch.py:24: in <module>
    from azure.batch import BatchServiceClient, models as batch_models
E   ImportError: cannot import name 'BatchServiceClient' from 'azure.batch' (/usr/python/lib/python3.10/site-packages/azure/batch/__init__.py)
_____________________________________________________ ERROR collecting providers/microsoft/azure/tests/unit/microsoft/azure/operators/test_batch.py ______________________________________________________
ImportError while importing test module '/opt/airflow/providers/microsoft/azure/tests/unit/microsoft/azure/operators/test_batch.py'.
Hint: make sure your test modules/packages have valid Python names.
Traceback:

I'm not sure how those would be resolved in this PR as they are unrelated so I'd like to mark this PR for review. If you believe this is related to my PR please let me know and I'll look into this further.

I ran all the static checks locally and they passed, and the CI images all built successfully.

RaphCodec · 2026-07-04T23:19:33Z

@potiuk I reviewed the provider distributions tests / Compat test logs from this PR. A lot of the errors look to be import errors or a faillure to git remote add apache-https-for-providers . I've tried to debug the errors and followed the guide to test compatibility.

I have not been able to resolve the failing tests, yet. However, it doesn't appear that the code in my PR is causing the errors as, so I'm marking this for review.

I know that the Compat tests should pass to be in line with the PR quality standards, but I am not sure why the Compat tests are having import issues. If there is something that I am missing I'd be happy to fix it. I'll keep looking for a solution.

RaphCodec · 2026-07-08T01:16:40Z

provider distributions tests / Compat tests are passing now and CI images are building as of this run

devgonvarun · 2026-07-23T13:25:29Z

Hi, any updates on this PR? We are really looking forward to this feature being part of the next release.

RaphCodec · 2026-07-23T13:36:24Z

I'm just waiting for the pr to be reviewed. I have tried to address all the changes that were requested. I don't have any other changes for it as of now. I realized that I haven't rebased it in a bit, so I will rebase it later today. Probably in 8 hours or so.

Is it possible to review it in the meantime as the CI checks passed?

…ider

RaphCodec · 2026-07-26T16:43:03Z

I updated my feature and main bracnhes and was able to get the CI checks to pass again. Some of these test failed becuase my main branch was not up to date with upstream. I was only rebasing my feature branch and as soon as I updated my main branch also the tests started to pass again. I didn't realize I needed to update both, so I apologize for the confusion on my part.

Test runs:

Some test that failed still are the Additional PROD e2e tests and the k8s tests. Those are failing becuase they are looking for images in my fork that don't exist. I assume that those should be fine once the maintainer approved workflow runs, but please correct me if I am wrong. The provdier wheel test seems to be failing for a similiar reason, but all of the provider distirbution tests are passing.

The Build info, Go SDK Tests, Java SDK Tests, Java SDK Docs, Mypy provider checks and provider distribution tests (minus the wheel test) have all passed.

Miretpl

Similar to Jens review really - would appriciate other maintainer review

Miretpl · 2026-07-31T20:05:04Z

+        if (self.github_app_id is not None and self.github_installation_id is None) or (
+            self.github_app_id is None and self.github_installation_id is not None
+        ):


Suggested change

if (self.github_app_id is not None and self.github_installation_id is None) or (

self.github_app_id is None and self.github_installation_id is not None

):

if None in (self.github_app_id, self.github_installation_id):

Miretpl · 2026-07-31T20:17:29Z

+            # but also keep a dedicated attribute so configure_hook_env() can avoid
+            # treating the GitHub App PEM as an SSH key.
+            self.github_app_private_key = self.private_key
+            self.auth_token = ""


Shouldn't we require an empty password in the Airflow connection instead of silently setting this to an empty string?

Miretpl · 2026-07-31T20:20:09Z


        return " ".join(parts)

+    def _get_github_app_token(self):


Missing return annotation.

Miretpl · 2026-07-31T20:21:40Z

    @contextlib.contextmanager
    def configure_hook_env(self):
-        if self.private_key:
+        self._ensure_github_app_token()


We could move it under if below and remove the check in _ensure_github_app_token as it would be duplicated.

Miretpl · 2026-07-31T20:31:37Z

+            self.user_name, self.auth_token, self.github_app_token_exp = self._get_github_app_token()
+
+    @contextlib.contextmanager
+    def _github_app_askpass_env(self):


Missing return annotation type.

Miretpl · 2026-07-31T20:32:31Z

+            raise ValueError(
+                "Both 'github_app_id' and 'github_installation_id' must be provided to use GitHub App Authentication"
+            )
+        if self.github_app_id is not None and self.github_installation_id is not None:


Suggested change

if self.github_app_id is not None and self.github_installation_id is not None:

else:

Miretpl · 2026-07-31T20:41:16Z

+            self.user_name, self.auth_token, self.github_app_token_exp = self._get_github_app_token()
+
+    @contextlib.contextmanager
+    def _github_app_askpass_env(self):


Can't we use the currently implemented _passphrase_askpass_env, but with a modification for askpass_script 🤔?

boring-cyborg Bot added area:providers provider:git labels Mar 29, 2026

RaphCodec marked this pull request as draft March 29, 2026 21:22

RaphCodec force-pushed the feat/git-bundles-github-app-auth branch from 0639a51 to d080795 Compare March 29, 2026 22:53

RaphCodec marked this pull request as ready for review March 29, 2026 22:55

potiuk marked this pull request as draft April 1, 2026 19:04

kaxil requested a review from Copilot April 2, 2026 00:42

Copilot started reviewing on behalf of kaxil April 2, 2026 00:42 View session

Copilot AI reviewed Apr 2, 2026

View reviewed changes

RaphCodec force-pushed the feat/git-bundles-github-app-auth branch 5 times, most recently from 1abb9fb to 23cf74d Compare April 19, 2026 15:09

RaphCodec requested a review from Copilot April 19, 2026 15:11

Copilot started reviewing on behalf of RaphCodec April 19, 2026 15:12 View session

Copilot AI reviewed Apr 19, 2026

View reviewed changes

Comment thread providers/git/src/airflow/providers/git/hooks/git.py Outdated

Comment thread providers/git/tests/unit/git/hooks/test_git.py Outdated

RaphCodec force-pushed the feat/git-bundles-github-app-auth branch 3 times, most recently from 687fb39 to 533e92f Compare April 19, 2026 16:32

RaphCodec marked this pull request as ready for review April 19, 2026 16:40

RaphCodec force-pushed the feat/git-bundles-github-app-auth branch 4 times, most recently from 27884e7 to a2d5a9a Compare April 24, 2026 10:20

potiuk marked this pull request as draft April 27, 2026 23:20

RaphCodec force-pushed the feat/git-bundles-github-app-auth branch 2 times, most recently from 1a323e7 to e7e490c Compare May 31, 2026 18:45

RaphCodec marked this pull request as ready for review June 6, 2026 18:01

RaphCodec requested review from amoghrajesh, ashb, gopidesupavan and jscheffl as code owners June 6, 2026 18:01

RaphCodec force-pushed the feat/git-bundles-github-app-auth branch 3 times, most recently from 8f52fd5 to 6f49aca Compare June 8, 2026 11:18

jscheffl reviewed Jun 8, 2026

View reviewed changes

Comment thread providers/git/src/airflow/providers/git/hooks/git.py Outdated

jscheffl reviewed Jun 8, 2026

View reviewed changes

Comment thread scripts/ci/prek/known_airflow_exceptions.txt Outdated

jscheffl reviewed Jun 9, 2026

View reviewed changes

RaphCodec force-pushed the feat/git-bundles-github-app-auth branch from 0976f2c to 19aa746 Compare June 12, 2026 10:19

RaphCodec requested a review from potiuk June 12, 2026 10:24

RaphCodec force-pushed the feat/git-bundles-github-app-auth branch 3 times, most recently from 6e4ad47 to c127dfe Compare June 17, 2026 09:58

RaphCodec and others added 4 commits July 25, 2026 23:56

add GitHub App Authentication as an option for DagBundles in git prov…

0c75080

…ider

update github app tests for git provider

99c8c49

add auto generated provider docs for optional github dependency

9d5492b

add pygithub to dev group for git provider

aa206df

Miretpl requested changes Jul 31, 2026

View reviewed changes

	if self.github_app_id is not None and self.github_installation_id is not None:
	else:

Uh oh!

Conversation

RaphCodec commented Mar 29, 2026 • edited by potiuk Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Was generative AI tooling used to co-author this PR?

Uh oh!

boring-cyborg Bot commented Mar 29, 2026

Uh oh!

potiuk commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

RaphCodec commented Apr 19, 2026

Uh oh!

potiuk commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

RaphCodec commented Jun 6, 2026

Uh oh!

Uh oh!

Uh oh!

jscheffl left a comment

Choose a reason for hiding this comment

Uh oh!

RaphCodec commented Jun 28, 2026

Uh oh!

RaphCodec commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

RaphCodec commented Jul 8, 2026

Uh oh!

devgonvarun commented Jul 23, 2026

Uh oh!

RaphCodec commented Jul 23, 2026

Uh oh!

RaphCodec commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Miretpl left a comment

Choose a reason for hiding this comment

Uh oh!

Miretpl Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Miretpl Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Miretpl Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Miretpl Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Miretpl Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Miretpl Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Miretpl Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

RaphCodec commented Mar 29, 2026 •

edited by potiuk

Loading

potiuk commented Apr 1, 2026 •

edited

Loading

potiuk commented Apr 27, 2026 •

edited

Loading

RaphCodec commented Jul 4, 2026 •

edited

Loading

RaphCodec commented Jul 26, 2026 •

edited

Loading