feat: add github authentication provider (#42)

jrichter1 · web-flow · commit 06eab816fc5c · 2026-03-04T15:42:27.000+05:30
* feat: add github authentication provider

Signed-off-by: Jan Richter &lt;jrichter@redhat.com&gt;

* remove integration providers

Signed-off-by: Jan Richter &lt;jrichter@redhat.com&gt;

* cleanup and upversion

Signed-off-by: Jan Richter &lt;jrichter@redhat.com&gt;

---------

Signed-off-by: Jan Richter &lt;jrichter@redhat.com&gt;
diff --git a/docs/.vitepress/config.ts b/docs/.vitepress/config.ts
@@ -33,7 +33,7 @@ export default defineConfig({
       { text: "Examples", link: "/examples/" },
       { text: "Overlay Testing", link: "/overlay/" },
       {
-        text: "v1.1.12",
+        text: "v1.1.13",
         items: [{ text: "Changelog", link: "/changelog" }],
       },
     ],
diff --git a/docs/api/helpers/login-helper.md b/docs/api/helpers/login-helper.md
@@ -46,9 +46,9 @@ async loginAsGithubUser(): Promise<void>
 Login using GitHub OAuth.
 
 **Required environment variables:**
-- `GH_USER_NAME`
-- `GH_USER_PASSWORD`
-- `GH_2FA_SECRET`
+- `VAULT_GH_USER_NAME`
+- `VAULT_GH_USER_PASSWORD`
+- `VAULT_GH_2FA_SECRET`
 
 ### `signOut()`
 
diff --git a/docs/changelog.md b/docs/changelog.md
@@ -2,6 +2,23 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.1.13] - Current
+
+### Added
+- Support for GitHub authentication provider
+
+### Changed
+- `LoginHelper.loginAsGithubUser` now pulls default user credentials from the following vault keys: `VAULT_GH_USER_ID`, `VAULT_GH_USER_PASS`, `VAULT_GH_2FA_SECRET` 
+- `APIHelper.githubRequest` pulls default user token from vault key `VAULT_GITHUB_USER_TOKEN`
+
+### Environment Variables
+-  `VAULT_GITHUB_OAUTH_OVERLAYS_APP_ID` - ID for GitHub OAuth application used as auth provider
+-  `VAULT_GITHUB_OAUTH_OVERLAYS_APP_SECRET`- Client secret for GitHub OAuth application
+-  `VAULT_GH_USER_ID` - GitHub user name
+-  `VAULT_GH_USER_PASS` - GitHub user password
+-  `VAULT_GH_2FA_SECRET` - GitHub user secret for 2 factor authentication
+-  `VAULT_GITHUB_USER_TOKEN` - Github user token
+
 ## [1.1.12] - Current
 
 ### Changed
diff --git a/docs/guide/configuration/environment-variables.md b/docs/guide/configuration/environment-variables.md
@@ -83,10 +83,10 @@ For GitHub integration:
 
 | Variable | Description | Required |
 |----------|-------------|----------|
-| `GITHUB_TOKEN` | GitHub personal access token | For API/auth |
-| `GH_USER_NAME` | GitHub username | For login |
-| `GH_USER_PASSWORD` | GitHub password | For login |
-| `GH_2FA_SECRET` | 2FA secret for OTP | For login |
+| `VAULT_GITHUB_USER_TOKEN` | GitHub personal access token | For API/auth |
+| `VAULT_GH_USER_NAME` | GitHub username | For login |
+| `VAULT_GH_USER_PASSWORD` | GitHub password | For login |
+| `VAULT_GH_2FA_SECRET` | 2FA secret for OTP | For login |
 
 ## Custom Variables
 
diff --git a/docs/guide/deployment/authentication.md b/docs/guide/deployment/authentication.md
@@ -8,6 +8,7 @@ The package supports modular authentication configuration, allowing you to switc
 |----------|-------------|----------|
 | `guest` | Simple guest authentication | Development, simple tests |
 | `keycloak` | OIDC via Keycloak | Production-like auth testing |
+| `github` | OAuth via GitHub | Testing where github authentication is needed |
 
 ## Guest Authentication
 
@@ -116,6 +117,33 @@ test.beforeAll(async ({ rhdh }) => {
 - Production-like testing scenarios
 - Testing logout/session flows
 
+
+## GitHub Authentication
+
+Allows authentication using github OAuth application. 
+
+### Configuration
+
+```typescript
+await rhdh.configure({ auth: "github" });
+await rhdh.deploy();
+```
+
+### Logging in to GitHub
+
+GitHub login is available via `LoginHelper`:
+
+```typescript
+test.beforeEach(async ({ loginHelper }) => {
+  await loginHelper.loginAsGithubUser();
+});
+```
+By default, test user credentials will be pulled from the global workspace in vault.
+
+::: warning
+GitHub authentication requires 2FA secret for automated logins. This is more complex to set up than guest or Keycloak auth.
+:::
+
 ## Environment Variables
 
 ### Guest Auth
@@ -135,9 +163,22 @@ These are automatically set by `KeycloakHelper.configureForRHDH()`:
 | `KEYCLOAK_METADATA_URL` | OIDC discovery URL |
 | `KEYCLOAK_LOGIN_REALM` | Login realm name |
 
+### GitHub Auth
+
+Configuring github auth provider will populate the following variables from global workspace in the vault:
+
+| Variable | Description |
+|----------|-------------|
+| `VAULT_GITHUB_OAUTH_OVERLAYS_APP_ID` | GitHub OAuth application ID |
+| `VAULT_GITHUB_OAUTH_OVERLAYS_APP_SECRET` | GitHub OAuth application client secret |
+| `VAULT_GH_USER_ID` | GitHub test user |
+| `VAULT_GH_USER_PASS` | Password for GitHub test user |
+| `VAULT_GH_2FA_SECRET` | Two-factor auth secret for GitHub test user |
+| `VAULT_GITHUB_USER_TOKEN` | Token for GitHub test user |
+
 ## Configuration Merging
 
-When you set `auth: "guest"` or `auth: "keycloak"`, the package automatically includes auth-specific configurations:
+When you set `auth: "guest"`, `auth: "keycloak"`, or `auth: "github"`, the package automatically includes auth-specific configurations:
 
 ```
 Package configs:
@@ -149,30 +190,16 @@ Package configs:
     ├── guest/                 # Applied when auth: "guest"
     │   └── app-config.yaml
     └── keycloak/              # Applied when auth: "keycloak"
+    │   ├── app-config.yaml
+    │   ├── dynamic-plugins.yaml
+    │   └── secrets.yaml
+    └── github/                # Applied when auth: "github"
         ├── app-config.yaml
-        ├── dynamic-plugins.yaml
         └── secrets.yaml
 ```
 
 Your project configs are merged on top, so you only need to override what's different.
 
-## GitHub Authentication
-
-GitHub authentication is available via `LoginHelper`:
-
-```typescript
-// Requires environment variables:
-// GH_USER_NAME, GH_USER_PASSWORD, GH_2FA_SECRET
-
-test.beforeEach(async ({ loginHelper }) => {
-  await loginHelper.loginAsGithubUser();
-});
-```
-
-::: warning
-GitHub authentication requires 2FA secret for automated logins. This is more complex to set up than guest or Keycloak auth.
-:::
-
 ## Switching Auth Providers
 
 ### In Different Test Files
@@ -189,6 +216,12 @@ test.beforeAll(async ({ rhdh }) => {
   await rhdh.configure({ auth: "keycloak" });
   await rhdh.deploy();
 });
+
+// github-tests.spec.ts
+test.beforeAll(async ({ rhdh }) => {
+  await rhdh.configure({ auth: "github" });
+  await rhdh.deploy();
+});
 ```
 
 ### In Different Projects
@@ -205,6 +238,10 @@ export default defineConfig({
       name: "keycloak-tests",
       testMatch: "**/keycloak-*.spec.ts",
     },
+    {
+      name: "github-tests",
+      testMatch: "**/github-*.spec.ts",
+    },
   ],
 });
 ```
@@ -215,6 +252,7 @@ Each project gets its own namespace and deployment with different auth.
 
 1. **Use guest auth for speed** - Faster to set up and run
 2. **Use Keycloak for RBAC testing** - When you need user roles
-3. **Create test users per test suite** - Avoid shared state
-4. **Clean up custom users** - Remove users created during tests
-5. **Use environment variables** - Don't hardcode credentials
+3. **Use GitHub for tests that connect to Github** - When you need authentication to GitHub
+4. **Create test users per test suite** - Avoid shared state
+5. **Clean up custom users** - Remove users created during tests
+6. **Use environment variables** - Don't hardcode credentials
diff --git a/docs/guide/helpers/login-helper.md b/docs/guide/helpers/login-helper.md
@@ -62,9 +62,9 @@ await loginHelper.loginAsGithubUser();
 ```
 
 Required environment variables:
-- `GH_USER_NAME` - GitHub username
-- `GH_USER_PASSWORD` - GitHub password
-- `GH_2FA_SECRET` - GitHub 2FA secret (for OTP generation)
+- `VAULT_GH_USER_NAME` - GitHub username
+- `VAULT_GH_USER_PASSWORD` - GitHub password
+- `VAULT_GH_2FA_SECRET` - GitHub 2FA secret (for OTP generation)
 
 ::: warning
 GitHub login requires 2FA secret for automated OTP generation. This is more complex to set up.
@@ -192,9 +192,9 @@ test("login flow", async ({ page, loginHelper }) => {
 
 | Variable | Description | Required |
 |----------|-------------|----------|
-| `GH_USER_NAME` | GitHub username | Yes |
-| `GH_USER_PASSWORD` | GitHub password | Yes |
-| `GH_2FA_SECRET` | 2FA secret for OTP | Yes |
+| `VAULT_GH_USER_NAME` | GitHub username | Yes |
+| `VAULT_GH_USER_PASSWORD` | GitHub password | Yes |
+| `VAULT_GH_2FA_SECRET` | 2FA secret for OTP | Yes |
 
 ## Troubleshooting
 
diff --git a/docs/overlay/examples/basic-plugin.md b/docs/overlay/examples/basic-plugin.md
@@ -68,7 +68,7 @@ workspaces/<plugin>/e2e-tests/
     "eslint-plugin-check-file": "^3.3.1",
     "eslint-plugin-playwright": "^2.4.0",
     "prettier": "^3.7.4",
-    "@red-hat-developer-hub/e2e-test-utils": "1.1.12",
+    "@red-hat-developer-hub/e2e-test-utils": "1.1.13",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.50.0"
   }
diff --git a/docs/overlay/examples/tech-radar.md b/docs/overlay/examples/tech-radar.md
@@ -71,7 +71,7 @@ workspaces/tech-radar/e2e-tests/
     "eslint-plugin-check-file": "^3.3.1",
     "eslint-plugin-playwright": "^2.4.0",
     "prettier": "^3.7.4",
-    "@red-hat-developer-hub/e2e-test-utils": "1.1.12",
+    "@red-hat-developer-hub/e2e-test-utils": "1.1.13",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.50.0"
   }
diff --git a/docs/overlay/test-structure/directory-layout.md b/docs/overlay/test-structure/directory-layout.md
@@ -68,7 +68,7 @@ Defines the test package with dependencies and scripts:
     "eslint-plugin-check-file": "^3.3.1",
     "eslint-plugin-playwright": "^2.4.0",
     "prettier": "^3.7.4",
-    "@red-hat-developer-hub/e2e-test-utils": "1.1.12",
+    "@red-hat-developer-hub/e2e-test-utils": "1.1.13",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.50.0"
   }
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@red-hat-developer-hub/e2e-test-utils",
-  "version": "1.1.12",
+  "version": "1.1.13",
   "description": "Test utilities for RHDH E2E tests",
   "license": "Apache-2.0",
   "repository": {
diff --git a/src/deployment/rhdh/config/auth/github/app-config.yaml b/src/deployment/rhdh/config/auth/github/app-config.yaml
@@ -0,0 +1,17 @@
+auth:
+  environment: production
+  session:
+    secret: superSecretSecret
+  providers:
+    github:
+      production:
+        clientSecret: ${GITHUB_OAUTH_APP_SECRET}
+        clientId: ${GITHUB_OAUTH_APP_ID}
+        callbackUrl: ${RHDH_BASE_URL}/api/auth/github/handler/frame
+signInPage: github
+catalog:
+  locations:
+    - type: url
+      target: https://github.com/janus-qe/test-user-entity/blob/main/user.yaml
+      rules:
+        - allow: [User]
diff --git a/src/deployment/rhdh/config/auth/github/secrets.yaml b/src/deployment/rhdh/config/auth/github/secrets.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: rhdh-secrets
+type: Opaque
+stringData:
+  GITHUB_OAUTH_APP_ID: $VAULT_GITHUB_OAUTH_OVERLAYS_APP_ID
+  GITHUB_OAUTH_APP_SECRET: $VAULT_GITHUB_OAUTH_OVERLAYS_APP_SECRET
+  GH_USER_ID: $VAULT_GH_USER_ID
+  GH_USER_PASS: $VAULT_GH_USER_PASS
+  GH_2FA_SECRET: $VAULT_GH_2FA_SECRET
+  GH_RHDH_QE_USER_TOKEN: $VAULT_GITHUB_USER_TOKEN
diff --git a/src/deployment/rhdh/constants.ts b/src/deployment/rhdh/constants.ts
@@ -1,5 +1,6 @@
 import path from "path";
 import type { AuthProvider } from "./types.js";
+import { MergeOptions } from "../../utils/merge-yamls.js";
 
 // Navigate from dist/deployment/rhdh/ to package root
 const PACKAGE_ROOT = path.resolve(import.meta.dirname, "../../..");
@@ -33,7 +34,12 @@ export const DEFAULT_CONFIG_PATHS = {
 
 export const AUTH_CONFIG_PATHS: Record<
   AuthProvider,
-  { appConfig: string; secrets: string; dynamicPlugins: string }
+  {
+    appConfig: string;
+    secrets: string;
+    dynamicPlugins: string;
+    mergeStrategy?: MergeOptions;
+  }
 > = {
   guest: {
     appConfig: path.join(
@@ -57,6 +63,18 @@ export const AUTH_CONFIG_PATHS: Record<
       "dist/deployment/rhdh/config/auth/keycloak/dynamic-plugins.yaml",
     ),
   },
+  github: {
+    appConfig: path.join(
+      PACKAGE_ROOT,
+      "dist/deployment/rhdh/config/auth/github/app-config.yaml",
+    ),
+    secrets: path.join(
+      PACKAGE_ROOT,
+      "dist/deployment/rhdh/config/auth/github/secrets.yaml",
+    ),
+    dynamicPlugins: "",
+    mergeStrategy: { arrayMergeStrategy: { byKey: "target" } },
+  },
 };
 
 export const CHART_URL = "oci://quay.io/rhdh/chart";
diff --git a/src/deployment/rhdh/deployment.ts b/src/deployment/rhdh/deployment.ts
@@ -64,11 +64,14 @@ export class RHDHDeployment {
 
   private async _applyAppConfig(): Promise<void> {
     const authConfig = AUTH_CONFIG_PATHS[this.deploymentConfig.auth];
-    const appConfigYaml = await mergeYamlFilesIfExists([
-      DEFAULT_CONFIG_PATHS.appConfig,
-      authConfig.appConfig,
-      this.deploymentConfig.appConfig,
-    ]);
+    const appConfigYaml = await mergeYamlFilesIfExists(
+      [
+        DEFAULT_CONFIG_PATHS.appConfig,
+        authConfig.appConfig,
+        this.deploymentConfig.appConfig,
+      ],
+      authConfig.mergeStrategy,
+    );
     this._logBoxen("App Config", appConfigYaml);
 
     await this.k8sClient.applyConfigMapFromObject(
diff --git a/src/deployment/rhdh/types.ts b/src/deployment/rhdh/types.ts
@@ -1,5 +1,5 @@
 export type DeploymentMethod = "helm" | "operator";
-export type AuthProvider = "guest" | "keycloak";
+export type AuthProvider = "guest" | "keycloak" | "github";
 
 export type DeploymentOptions = {
   version?: string;
diff --git a/src/playwright/helpers/api-helper.ts b/src/playwright/helpers/api-helper.ts
@@ -23,7 +23,7 @@ export class APIHelper {
       method: method,
       headers: {
         Accept: "application/vnd.github+json",
-        Authorization: `Bearer ${process.env.GH_RHDH_QE_USER_TOKEN}`,
+        Authorization: `Bearer ${process.env.VAULT_GITHUB_USER_TOKEN}`,
         "X-GitHub-Api-Version": this.githubAPIVersion,
       },
     };
diff --git a/src/playwright/helpers/common.ts b/src/playwright/helpers/common.ts

Original file line number	Diff line number	Diff line change
`@@ -33,7 +33,7 @@ export default defineConfig({`
`33`	`33`	`{ text: "Examples", link: "/examples/" },`
`34`	`34`	`{ text: "Overlay Testing", link: "/overlay/" },`
`35`	`35`	`{`
`36`		`- text: "v1.1.12",`
	`36`	`+ text: "v1.1.13",`
`37`	`37`	`items: [{ text: "Changelog", link: "/changelog" }],`
`38`	`38`	`},`
`39`	`39`	`],`
Original file line number	Diff line number	Diff line change
`@@ -68,7 +68,7 @@ workspaces/<plugin>/e2e-tests/`
`68`	`68`	`"eslint-plugin-check-file": "^3.3.1",`
`69`	`69`	`"eslint-plugin-playwright": "^2.4.0",`
`70`	`70`	`"prettier": "^3.7.4",`
`71`		`- "@red-hat-developer-hub/e2e-test-utils": "1.1.12",`
	`71`	`+ "@red-hat-developer-hub/e2e-test-utils": "1.1.13",`
`72`	`72`	`"typescript": "^5.9.3",`
`73`	`73`	`"typescript-eslint": "^8.50.0"`
`74`	`74`	`}`
Original file line number	Diff line number	Diff line change
`@@ -71,7 +71,7 @@ workspaces/tech-radar/e2e-tests/`
`71`	`71`	`"eslint-plugin-check-file": "^3.3.1",`
`72`	`72`	`"eslint-plugin-playwright": "^2.4.0",`
`73`	`73`	`"prettier": "^3.7.4",`
`74`		`- "@red-hat-developer-hub/e2e-test-utils": "1.1.12",`
	`74`	`+ "@red-hat-developer-hub/e2e-test-utils": "1.1.13",`
`75`	`75`	`"typescript": "^5.9.3",`
`76`	`76`	`"typescript-eslint": "^8.50.0"`
`77`	`77`	`}`
Original file line number	Diff line number	Diff line change
`@@ -68,7 +68,7 @@ Defines the test package with dependencies and scripts:`
`68`	`68`	`"eslint-plugin-check-file": "^3.3.1",`
`69`	`69`	`"eslint-plugin-playwright": "^2.4.0",`
`70`	`70`	`"prettier": "^3.7.4",`
`71`		`- "@red-hat-developer-hub/e2e-test-utils": "1.1.12",`
	`71`	`+ "@red-hat-developer-hub/e2e-test-utils": "1.1.13",`
`72`	`72`	`"typescript": "^5.9.3",`
`73`	`73`	`"typescript-eslint": "^8.50.0"`
`74`	`74`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@red-hat-developer-hub/e2e-test-utils",`
`3`		`- "version": "1.1.12",`
	`3`	`+ "version": "1.1.13",`
`4`	`4`	`"description": "Test utilities for RHDH E2E tests",`
`5`	`5`	`"license": "Apache-2.0",`
`6`	`6`	`"repository": {`