feat: opt-in gh app integration

[plyr4]

this PR adds opt-in GitHub App integrations to the server.

the main differences are:

• integrate with an OAuth GitHub App by providing an app id and private key
• use the GitHub App to generate the .netrc password for builds when the app is installed and it can access the repo
• adds webhook handlers for GitHub App installation and installation_repositories events, and syncs existing repos when changes are made
• adds Checks functionality, pulled from the original hackathon efforts feat: add github app #1070
  • pulled out this code, it will be a follow-up PR

New Flags

Key	Description	Default Value
VELA_SCM_APP_ID	set to the App ID for the GitHub App	N/A
VELA_SCM_APP_PRIVATE_KEY	the string value for the GitHub App private key generated through GitHub	N/A

Required GitHub App Configurations

Permissions

the GitHub App requires the following permissions at the very minimum:

• contents:read
• checks:write

builds would request write permissions through the git yaml block, see below.

Subscribed Events

• Installation target

OAuth

the same configurations and oauth scopes should be assigned to the GitHub App, including:

• oauth callback url set to /authenticate (like usual)
• Webhook URL set to the base url (like usual)

New YAML block: git

integrating with a GitHub App allows the use of the git YAML block for customizing the permissions allocated to the netrc password embedded into Vela steps.

git:
  token:
    repositories:
      - foo/bar
      - helloworld
    permissions:
      contents: write
      checks: write

this lets users customize the list of repositories that the netrc password has access to, but that list is restricted to ONLY the repos that the GitHub App org installation has been given access to.

by default, the compiler will use the following configurations unless otherwise provided:

git:
  token:
    repositories:
      - VELA_BUILD_REPO
    permissions:
      contents: read
      checks: write

⚠️ Netrc Considerations

this WILL impact builds, check out the following list of things to consider when migrating to GitHub App

Cloning Private Repositories

Vela builds might lose the ability to read/write from certain private repos that the repo owner may have had access to due to the new restrictive policies set on the netrc token.

GitHub Apps do not support providing access to repos that are outside the installation org. meaning, for a Vela build to access private repos, Go modules, etc, that are outside of the repo's org then the build author must provide override the clone step and use an alternative authentication method like a PAT

⚠️ OAuth Considerations

For this release, we recommend using a combination of both an OAuth app and a GitHub App with Authorization disabled.
The rest of the code base is not prepared to require user App installations, see the below examples for why.

Enabling Private Repositories (/source/repos)

Vela users will lose the ability to enable private repositories unless the GitHub App is installed to their personal account. this is due to changes to the default permissions when using a GitHub App as an OAuth provider.
see: https://docs.github.com/en/[email protected]/apps/using-github-apps/authorizing-github-apps#difference-between-authorization-and-installation

[wass3rw3rk]

super minor stuff; tested functionally and works in both modes as advertised. non-breaking change until you enable app integration. nice work.

[wass3rw3rk]

maybe support both. i know some envs prefer no file access and this would be the first item in the config that does, afaik. i'm ok leaving it as-is and bake in file support in separate PR.