feat: update github auth (#169)

更新 github auth 验证方法，需要部署上去试试

.github/workflows/aws-preview.yml

@@ -2,20 +2,20 @@ name: Deploy Backend to Preview ECS
 
 on:
   push:
-    branches: ["main"]
+    branches: ['main']
     paths:
-      - "server/**"
+      - 'server/**'
   pull_request:
-    branches: [ "main" ]
+    branches: ['main']
 
 env:
   AWS_REGION: ap-northeast-1
   ECR_REPOSITORY: petercat-lambda
   ECR_REGISTRY: 654654285942.dkr.ecr.ap-northeast-1.amazonaws.com
 
 permissions:
-  id-token: write   # This is required for requesting the JWT
-  contents: read    # This is required for actions/checkout
+  id-token: write # This is required for requesting the JWT
+  contents: read # This is required for actions/checkout
 
 jobs:
   deploy:
@@ -54,3 +54,4 @@ jobs:
                                   APIIdentifier=${{ secrets.API_IDENTIFIER }} \
                                   FastAPISecretKey=${{ secrets.FASTAPI_SECRET_KEY }} \
                                   GitHubToken=${{ secrets.X_GITHUB_TOKEN }}
+                                  GithubInstallationId=${{ secrets.X_GITHUB_INSTALLATION_ID }}

.github/workflows/aws-prod.yml

@@ -2,16 +2,16 @@ name: Deploy Backend to Product ECS
 
 on:
   push:
-    branches: ["main"]
+    branches: ['main']
 
 env:
   AWS_REGION: ap-northeast-1
   ECR_REPOSITORY: petercat-lambda
   ECR_REGISTRY: 654654285942.dkr.ecr.ap-northeast-1.amazonaws.com
 
 permissions:
-  id-token: write   # This is required for requesting the JWT
-  contents: read    # This is required for actions/checkout
+  id-token: write # This is required for requesting the JWT
+  contents: read # This is required for actions/checkout
 
 jobs:
   deploy:
@@ -49,4 +49,4 @@ jobs:
                                   TavilyAPIKey=${{ secrets.TAVILY_API_KEY }} \
                                   APIIdentifier=${{ secrets.API_IDENTIFIER }} \
                                   FastAPISecretKey=${{ secrets.FASTAPI_SECRET_KEY }} \
-                                  GitHubToken=${{ secrets.X_GITHUB_TOKEN }}
+                                  GithubInstallationId=${{ secrets.X_GITHUB_INSTALLATION_ID }}

server/.env.example

@@ -4,6 +4,7 @@ SUPABASE_SERVICE_KEY=supabase_service_key
 
 # OPTIONAL - Github Apps Configures
 X_GITHUB_APP_ID=github_app_id
+X_GITHUB_INSTALLATION_ID=installation_id
 X_GITHUB_APPS_CLIENT_ID=github_apps_client_id
 X_GITHUB_APPS_CLIENT_SECRET=github_apps_client_secret
 

server/rag_helper/task.py

@@ -3,13 +3,23 @@
 
 from github import Auth, Repository
 from github import Github
-from langchain_core.utils import get_from_env
 
 from data_class import GitDocConfig
 from db.supabase.client import get_client
 from rag_helper import retrieval
+from uilts.env import get_env_variable
+from uilts.github import get_private_key
 
-g = Github(auth=Auth.Token(get_from_env("access_token", 'GITHUB_TOKEN')))
+APP_ID = get_env_variable("X_GITHUB_APP_ID")
+GITHUB_INSTALLATION_ID = get_env_variable("X_GITHUB_INSTALLATION_ID")
+
+auth = Auth.AppAuth(
+    app_id=APP_ID,
+    private_key=get_private_key(),
+    jwt_algorithm="RS256"
+).get_installation_auth(installation_id=int(GITHUB_INSTALLATION_ID))
+
+g = Github(auth)
 
 TABLE_NAME = "rag_tasks"
 

server/routers/rag.py

@@ -18,7 +18,7 @@
 def add_knowledge_by_doc(config: GitDocConfig):
     try:
         result = retrieval.add_knowledge_by_doc(config)
-        if (result):
+        if result:
             return json.dumps({
                 "success": True,
                 "message": "Knowledge added successfully!",

template.yml

@@ -3,6 +3,7 @@ Transform: AWS::Serverless-2016-10-31
 Description: >
   Streaming Bedrock Response with FastAPI on AWS Lambda
 
+
 # More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
 Globals:
   Function:
@@ -21,6 +22,10 @@ Parameters:
     Type: String
     Description: Github Token
     Default: 1
+  GithubInstallationId:
+    Type: String
+    Description: GithubInstallationId
+    Default: 1
   APIIdentifier:
     Type: String
     Description: APIIdentifier
@@ -62,6 +67,7 @@ Resources:
           X_GITHUB_APP_ID: !Ref GitHubAppID
           X_GITHUB_APPS_CLIENT_ID: !Ref GithubAppsClientId
           X_GITHUB_APPS_CLIENT_SECRET: !Ref GithubAppsClientSecret
+          X_GITHUB_INSTALLATION_ID: !Ref GithubInstallationId
           API_IDENTIFIER: !Ref APIIdentifier
           FASTAPI_SECRET_KEY: !Ref FastAPISecretKey
           OPENAI_API_KEY: !Ref OpenAIAPIKey
@@ -73,12 +79,12 @@ Resources:
         AuthType: NONE
         InvokeMode: RESPONSE_STREAM
       Policies:
-      - Statement:
-        - Sid: BedrockInvokePolicy
-          Effect: Allow
-          Action:
-          - bedrock:InvokeModelWithResponseStream
-          Resource: '*'
+        - Statement:
+            - Sid: BedrockInvokePolicy
+              Effect: Allow
+              Action:
+                - bedrock:InvokeModelWithResponseStream
+              Resource: '*'
       Tracing: Active
     Metadata:
       DockerContext: server
@@ -87,8 +93,8 @@ Resources:
 
 Outputs:
   FastAPIFunctionUrl:
-    Description: "Function URL for FastAPI function"
+    Description: 'Function URL for FastAPI function'
     Value: !GetAtt FastAPIFunctionUrl.FunctionUrl
   FastAPIFunction:
-    Description: "FastAPI Lambda Function ARN"
-    Value: !GetAtt FastAPIFunction.Arn
+    Description: 'FastAPI Lambda Function ARN'
+    Value: !GetAtt FastAPIFunction.Arn