Allows the workflow to configure access to private Go modules. (#33)

* Fix _checks-golang

* Adds support for private Go modules

Allows the workflow to configure access to private Go modules.
It adds an input parameter `goprivate` to specify the module path prefixes.
It also configures Git to use the GitHub App token for authentication
when accessing private repositories.

* _atlas-migratios: Enables checkout using GitHub App authentication

Adds support for authenticating with a GitHub App to access private repositories.
This allows the workflow to checkout code and configure Git using the GitHub App's token,
enabling access to repositories without relying on user-specific credentials.

Also adds support for configuring GOPRIVATE environment variable.

* Enables GitHub App authentication for private repos

Adds support for authenticating with a GitHub App to access private repositories during the build process.
This allows the workflow to clone private repositories and use their contents during the Docker image build.
It configures Git to use a GitHub App token for authentication and passes the token as a build argument.

* minor changes

* minor change

* minor changes

* minor change

* test actions

* changes

* test new branch

* test on checks-golang

* use @main actions

Author: lucaslopezf

.github/workflows/_atlas-migrations-reusable.yml

@@ -62,10 +62,31 @@ on:
         description: "Whether to use Google Cloud SQL instead of traditional PostgreSQL"
         type: boolean
         default: false
+      github_app_auth:
+        description: "Use GitHub App Token"
+        required: false
+        type: boolean
+        default: false
+      github_app_repos:
+        description: "Additional repositories to access (one per line)"
+        required: false
+        type: string
+        default: ""
+      goprivate:
+        description: "Comma-separated list of module path prefixes for GOPRIVATE"
+        required: false
+        type: string
+        default: ""
     secrets:
       DATABASE_URL:
         description: "Database connection URL for the target environment (for traditional PostgreSQL)"
         required: false
+      app_id:
+        description: "GitHub App ID"
+        required: false
+      app_pem:
+        description: "GitHub App PEM"
+        required: false
     outputs:
       migration_status:
         description: "Status of the migration operation"
@@ -98,8 +119,17 @@ jobs:
           - 5432:5432
 
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - name: Checkout with GitHub App
+        id: checkout
+        uses: zondax/_actions/checkout-with-app@main
+        with:
+          github_app_auth: ${{ inputs.github_app_auth }}
+          github_app_repos: ${{ inputs.github_app_repos }}
+          patch_git_config: false
+          checkout_submodules: true
+          app_id: ${{ secrets.app_id }}
+          app_pem: ${{ secrets.app_pem }}
+          goprivate: ${{ inputs.goprivate }}
 
       - name: Setup Go
         uses: actions/setup-go@v4

.github/workflows/_checks-golang.yaml

@@ -45,6 +45,11 @@ on:
         required: false
         type: boolean
         default: true
+      goprivate:
+        description: "Comma-separated list of module path prefixes for GOPRIVATE"
+        required: false
+        type: string
+        default: ""
     secrets:
       app_id:
         description: "GitHub App ID"
@@ -71,15 +76,15 @@ jobs:
 
     steps:
       - name: Checkout with GitHub App
+        id: checkout
         uses: zondax/_actions/checkout-with-app@main
         with:
           github_app_auth: ${{ inputs.github_app_auth }}
-          github_app_repos: |
-            ${{ github.repository }}
-            ${{ inputs.github_app_repos }}
+          github_app_repos: ${{ inputs.github_app_repos }}
           checkout_submodules: true
           app_id: ${{ secrets.app_id }}
           app_pem: ${{ secrets.app_pem }}
+          goprivate: ${{ inputs.goprivate }}
 
       - name: Build
         run: |

.github/workflows/_cloud-run-build-docker.yml

@@ -26,10 +26,27 @@ on:
         required: false
         type: string
         default: ''
+      github_app_auth:
+        description: "Use GitHub App Token"
+        required: false
+        type: boolean
+        default: false
+      github_app_repos:
+        description: "Additional repositories to access (one per line)"
+        required: false
+        type: string
+        default: ""
     outputs:
       image_tag:
         description: "The full tag of the built image."
         value: ${{ jobs.build.outputs.image_tag }}
+    secrets:
+      app_id:
+        description: "GitHub App ID"
+        required: false
+      app_pem:
+        description: "GitHub App PEM"
+        required: false
 jobs:
   build:
     runs-on: zondax-runners
@@ -41,7 +58,16 @@ jobs:
       contents: read # Required for actions/checkout and GitHub API access
       pull-requests: write # Required for commenting on PRs
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout with GitHub App
+        id: checkout
+        uses: zondax/_actions/checkout-with-app@main
+        with:
+          github_app_auth: ${{ inputs.github_app_auth }}
+          github_app_repos: ${{ inputs.github_app_repos }}
+          patch_git_config: false
+          checkout_submodules: true
+          app_id: ${{ secrets.app_id }}
+          app_pem: ${{ secrets.app_pem }}
       - name: Authenticate with GCP
         uses: zondax/_actions/gcp-wif-auth@main
         with:
@@ -64,6 +90,15 @@ jobs:
             DOCKERFILE_FLAGS+=" -f $f"
           done
           IMAGE_TAG_SHA="${{ vars.PULUMI_GAR_LOCATION }}-docker.pkg.dev/${{ vars.PULUMI_GCP_PROJECT_ID }}/${{ vars.PULUMI_GAR_REPOSITORY }}/${{ inputs.image_name }}:${{ github.sha }}"
+          
+          # Use Docker secrets for GitHub token if GitHub App auth is enabled
+          if [ "${{ inputs.github_app_auth }}" = "true" ]; then
+            echo "${{ steps.checkout.outputs.token }}" > /tmp/github_token
+            SECRET_ARGS="--secret id=github_token,src=/tmp/github_token"
+          else
+            SECRET_ARGS=""
+          fi
+          
           if [ "${{ inputs.build_tool }}" = "bake" ]; then
             # If bake_targets is set, add them as arguments
             BAKE_TARGETS=""
@@ -73,10 +108,17 @@ jobs:
                 BAKE_TARGETS+=" $t"
               done
             fi
-            docker buildx bake $DOCKERFILE_FLAGS $BAKE_TARGETS --set "*.tags=$IMAGE_TAG_SHA"
+            if [ "${{ inputs.github_app_auth }}" = "true" ]; then
+              docker buildx bake $DOCKERFILE_FLAGS $BAKE_TARGETS --set "*.tags=$IMAGE_TAG_SHA" --secret id=github_token,src=/tmp/github_token
+            else
+              docker buildx bake $DOCKERFILE_FLAGS $BAKE_TARGETS --set "*.tags=$IMAGE_TAG_SHA"
+            fi
           else
-            docker build $DOCKERFILE_FLAGS --tag "$IMAGE_TAG_SHA" .
+            docker build $DOCKERFILE_FLAGS $SECRET_ARGS --tag "$IMAGE_TAG_SHA" .
           fi
+          
+          # Clean up token file
+          [ -f /tmp/github_token ] && rm -f /tmp/github_token
           echo "image_tag=$IMAGE_TAG_SHA" >> $GITHUB_OUTPUT
       - name: Push Docker image to Artifact Registry
         run: |