Allow `--github-token` to read from ~/.git-credentials

[infracost]

Allow `--github-token` to read from ~/.git-credentials

[vdmgolub]

Hello!

Thank you for creating the issue!

Could you please explain why CLI should read from this file, so I understand your context better? From my understanding, Atlantis is already aware of the GitHub token. The --write-git-creds option saves the token to the file, but Atlantis gets it from somewhere. I assume it is provided to Atlantis from an env var so that the same env var can be used for infracost comment. Or maybe you have a different setup.

UPD: You can also try to use our GitHub app integration which can take care of the private modules. You can read about the benefits here: https://www.infracost.io/docs/integrations/github_app/#benefits

[sudo0x]

infracost comment require --github-token to comment on PRs. My setup with Atlantis is via Github App, and Github App creates token on the fly. For my setup to work I have to pass generated token which is inside ~/.git-credentials manually. Can you help me how I can workaround manual passing of token to --github-token?

[vdmgolub]

According to the Atlantis source code it saves the URL in the format of https://user:[email protected]. If this is the case, you can add a line in your step with infracost comment command. For example:

      - run: |
          GITHUB_TOKEN=$(cat ~/.git-credentials | cut -d '@' -f1 | cut -d ':' -f3)
          infracost comment github --repo $BASE_REPO_OWNER/$BASE_REPO_NAME \
                                   --pull-request $PULL_NUM \
                                   --path /tmp/$BASE_REPO_OWNER-$BASE_REPO_NAME-$PULL_NUM/'*'-infracost.json \
                                   --github-token $GITHUB_TOKEN \
                                   --behavior new

Explanation of the $(cat ~/.git-credentials | cut -d '@' -f1 | cut -d ':' -f3):

1. cat ~/.git-credentials would produce https://user:[email protected]
2. The first cut -d '@' -f1 will split the string by @ and will pick the first (-f1) group - https://user:token
3. The second cut -d ':' -f3 will split the https://user:token substring into 3 groups https, //user and token where we pick the third one.
4. This output is assigned to an env var GITHUB_TOKEN which should be used as infracost comment's --github-token value.

I'm sure there are better ways to extract the token using sed/regex, but this works well too :) Please give it a try.

[sudo0x]

That's how I am doing it. My point was should not infracost comment supporting the Github App authentication and read the token from the file or is there better way to do this with Github App authentication?

[vdmgolub]

We tried to make infracost comment work for any setup where the explicit flag seems to be the most versatile. I believe it's the first time the GH app authentication was brought up for Atlantis. I could recommend trying our own GItHub app integration in Infracost Cloud: it's fast and easy to set up. It posts PR comments on a free plan as well. Can you give it a try? https://dashboard.infracost.io/

[alikhajeh1]

The Infracost GitHub App is now free: https://www.infracost.io/docs/integrations/github_app/