[ahal]

RUN_TASK_SECRETS is a JSON list of secrets for run-task to fetch before checkout. The first type, github-repo-token, requests a GitHub App installation token from Taskcluster's auth service and exports it to an environment variable, GITHUB_TOKEN by default. Tokens are also kept in memory so run-task can authenticate its own GitHub requests.

[ahal]

This adds the ability to fetch a Github app installation access token in run-task, which will be needed both for cloning private repos, as well as deriving a more accurate merge base from the Github API (follow-up PR coming for this).

As you might guess from the implementation, the intent here is to also support fetching Taskcluster secrets using this mechanism (a feature I've long meant to implement). But I'll tackle that part separately.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.13%. Comparing base (781b59f) to head (01cbd8b).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1105      +/-   ##
==========================================
+ Coverage   80.00%   80.13%   +0.13%     
==========================================
  Files         134      134              
  Lines       14190    14283      +93     
  Branches     1645     1654       +9     
==========================================
+ Hits        11352    11445      +93     
  Misses       2399     2399              
  Partials      439      439              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.