Github token auth not working

[d-weems]

My team and I are working on deploying a code-server instance behind an nginx reverse proxy in a Kubernetes cluster. We haven't been able to successfully use the github-auth feature to persistently authenticate the user with Github. The Github token is passed in as an environment variable and we've verified that it exists, however when performing a git clone for example we always get a pop-up asking for authentication anyway.

What we're trying to do is prevent the user from having to go through the Github OAuth flow. We already have separate process in our application where users go through this flow, so we already have their Github token available to us. They should not need to go through the OAuth flow again.

We've tried the following workarounds:

• Passing the GITHUB_TOKEN environment variable
  • GITHUB_TOKEN was always unset as an environment variable and we don't know why
  • So we switched to GIT_TOKEN and it was suddenly available
• Setting the github-auth flag in our code-server config file
  • Attempted with GITHUB_TOKEN and GIT_TOKEN

We were able to run this block in a running code-server and git clone without being prompted to authenticate:

git config --global credential.helper 'cache'
git credential approve <<EOF
protocol=https
host=github.com
username="$GIT_TOKEN" 
password=x-oauth-basic
EOF

However, we need this authentication to happen automatically and placing the above block in our .profile or .bashrc, which are persisted between deploys, didn't work either.

Are we doing something wrong or do we misunderstand what is the expected behavior? I see similar questions have been asked in the past; we've read these and tried implementing the answers but still have had no luck.
#5513
#5477

[code-asher]

I think those issues were from back when we had a custom implementation for GitHub auth, but that was removed a while back since VS Code added their own github-auth flag.

GITHUB_TOKEN was always unset as an environment variable and we don't know why

After reading them, we unset environment vars like GITHUB_TOKEN, PASSWORD, etc, to prevent extensions and other sub-processes from reading them. We then pass the token to VS Code via the --github-auth flag. From there I am not sure what VS Code does with the flag. I thought they used it to authenticate the GitHub extension but maybe there is a bug here.

I wonder if the token is missing scopes? I think user:email and repo are what it needs.

It would be ideal if we could test with VS Code web standalone to see if it is a code-server issue or upstream issue but looks like they have not added it to serve-web yet: microsoft/vscode#191861

[d-weems]

I'm not sure I understand your explanation. What is the connection between the authenticating with Github extension and testing the VS Code web standalone? Does code-server depend on serve-web?

Regardless, we were able to formulate a successful workaround with the following changes:

Dockerfile

ENTRYPOINT ["path to init script"]
# Removed the CMD below and moved to init script
# Run the s6 overlay services, e.g. start the code-server:
# CMD ["/init"]

init script

# removed this line
# exec "$@"
exec bash -c '
if [ -n "$GIT_TOKEN" ]; then
	git config --global credential.helper "cache --timeout=86400"
	git credential approve <<EOF
protocol=https
host=[github.com](http://github.com/)
username=$GIT_TOKEN
password=x-oauth-basic
EOF
fi

/init
'