feat: add GitHub Apps authentication support

[skroll]

Summary

Add GitHub Apps authentication support for situations where Concourse is not acting on behalf of a user, but on behalf of a GitHub App installation. GitHub Apps are a way for a non-user to be able to interact with a GitHub or GitHub Enterprise server. In particular, this is useful for Enterprise deployments where all human users are authenticated by SSO, and creating a machine user is not possible, or not permissible.

Inspiration for this work is from PR #459, which seems to have been abandoned.

Changes

• Implement setup_github_app_credentials and supporting functions, which handles setting a git credential helper for the specified endpoint, using a generated JWT exchanged for an app installation access token.

Features

• Handles github.com and non-githubproxy.fjygbaifeng.eu.org repositories, automatically deriving the API endpoint from the source.uri, such as instances when GitHub Enterprise is hosted on the ghe.com domain.
• Only requires the GitHub App ID (or Client ID), and discovers the GitHub App installation ID through the endpoints. Handles the 3 cases, where the App is installed for an organization, a user, or a repository.
• Scopes the token to a specific host using a git credential helper.

Notes

This functionality is useful for me since our company deployment of GitHub enterprise has all users authenticated via SSO, and so creating a bot user is not possible. Our current implementation has a Concourse job running every 5 minutes that generates access tokens and then updates our Vault instance with the tokens, however this means every team has the same credentials for the most part, and I reducing their scope without ballooning our access token job would be beneficial.

I know this one is a hefty change, and I did my best to make the new functions as logical as possible. I made sure the 2 curl calls are wrapped in a function, so they can be mocked out in the test suite. The biggest change here is the unit test code, since I did everything I could to make sure that the code behaves as it should, and handle the edge cases.

Any and all suggestions would be welcome, I'm willing to make any adjustments.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: skroll / name: Scott M. Kroll (f74aec1)

[taylorsilva]

Thanks for the PR! I've put it into my PR backlog. Got a lot on my plate so might be a while until I review.