Github authentication fails if OAuth token is updated in Secrets Manager [console] about github-codebuild-logs

[jlhood]

@mattsb42 The GitHub OAuth token is cached in memory by the app. Did you delete the old token after replacing it with a new one in secrets manager? If so, the app was probably trying to use the deleted token, resulting in the invalid token error from GitHub.

An enhancement that could be made to the app would be for GithubProxy to catch invalid token error and attempt to reinitialize the client (which would also reload the token).

[mattsb42]

Yes, I deleted the old token. I missed the client caching; yes, this is probably what was happening. Catching the invalid credentials error and re-loading credentials sounds like the right approach to me. We'll want to make sure we only try reloading once though.

[jlhood]

Why only try reloading once? What's the concern with always trying to reload it on invalid token error?

[mattsb42]

Just trying to avoid an infinite loop of it failing and reloading.

[honglu]

Not sure if it is the same issue for you. But I found it confusing when using secrets manager console. The console defaults the secrets to be either a key-value pair or a JSON String under Plaintext. I have to just copy paste my OAuth token there in Plaintext and remove the default JSON blob. Most of the time I just use AWS CLI to store my OAuth token:

aws secretsmanager create-secret --name GitHubOAuthToken --secret-string <my oauth token>

[jlhood]

@mattsb42 Just trying to avoid an infinite loop of it failing and reloading.

Oh I see. You mean only retry once per Lambda invocation. I was thinking the same thing. For a second I thought you meant ensuring it only retries once across Lambda invocations. 😅