[RFC-007] Implement GitHub app authentication for git repositories in IAC

[dipti-pai]

• Controller change to use the GitHub authentication information specified in gitrepository.spec.secretRef to create the auth options to authenticate to git repositories when the gitrepository.spec.provider field is set to github,
• Tests for new github provider field in IAC
• Updated docs to use GitHub Apps for authentication in image-automation-controller.

[makkes]

Reminder to remove these before merging.

[darkowlzz]

Based on the SC issue described in fluxcd/source-controller#1647 (comment), it would be good to perform a provider validation here too. In this case, we have a typed error already

image-automation-controller/internal/source/source.go

Line 47 in 5b945f7

var ErrInvalidSourceConfiguration = errors.New("invalid source configuration")

We can return an error with proper context, saying that the referred GitRepository's provider configuration is invalid. Wrapping the typed error with the context should allow the reader of the errors to determine that it should result in stalled state, with the context intact. Refer similar code in

image-automation-controller/internal/source/source.go

Lines 102 to 108 in 5b945f7

	if obj.Spec.SourceRef.Kind != sourcev1.GitRepositoryKind {
	return nil, fmt.Errorf("source kind '%s' not supported: %w", obj.Spec.SourceRef.Kind, ErrInvalidSourceConfiguration)
	}
	if obj.Spec.GitSpec == nil {
	return nil, fmt.Errorf("source kind '%s' necessitates field .spec.git: %w", sourcev1.GitRepositoryKind, ErrInvalidSourceConfiguration)
	}

and see how the reconciler interprets it

image-automation-controller/internal/controller/imageupdateautomation_controller.go

Lines 354 to 358 in 5b945f7

	if errors.Is(err, source.ErrInvalidSourceConfiguration) {
	conditions.MarkStalled(obj, imagev1.InvalidSourceConfigReason, "%s", err)
	result, retErr = ctrl.Result{}, nil
	return
	}

.

Since we have a watch for GitRepository in

image-automation-controller/internal/controller/imageupdateautomation_controller.go

Lines 140 to 143 in 5b945f7

	Watches(
	&sourcev1.GitRepository{},
	handler.EnqueueRequestsFromMapFunc(r.automationsForGitRepo),
	builder.WithPredicates(sourceConfigChangePredicate{}),

, the stalled ImageUpdateAutomation should be notified of any update to the GitRepository object to fix it and that'll result in a re-evaluation.

[darkowlzz]

Please also consider an update to the same issue in source-controller fluxcd/source-controller#1647 (comment).
I believe the same validations can be done within getAuthOpts().