[PR #10339/e5b37c3f backport][stable-10] github_release - support multiple type of tokens (#10372)

github_release - support multiple type of tokens (#10339)

* Support multiple type of tokens

* Add missing spaces around operator.

* Add changelog fragments.

* fix logic, missing NOT

* Update changelogs/fragments/10339-github_app_access_token.yml



---------


(cherry picked from commit e5b37c3ffd)

Co-authored-by: Bruno Lavoie <bl@brunol.com>
Co-authored-by: Felix Fontein <felix@fontein.de>

changelogs/fragments/10339-github_app_access_token.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - github_release - support multiple types of GitHub tokens; no longer failing when ``ghs_`` token type is provided (https://github.com/ansible-collections/community.general/issues/10338, https://github.com/ansible-collections/community.general/pull/10339).

plugins/modules/github_release.py

@@ -182,13 +182,29 @@ def main():
         else:
             gh_obj = github3.GitHub()
 
-        # test if we're actually logged in
-        if password or login_token:
+        # GitHub's token formats:
+        #   - ghp_          - Personal access token (classic)
+        #   - github_pat_   - Fine-grained personal access token
+        #   - gho_          - OAuth access token
+        #   - ghu_          - User access token for a GitHub App
+        #   - ghs_          - Installation access token for a GitHub App
+        #   - ghr_          - Refresh token for a GitHub App
+        #
+        # References:
+        #   https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/about-authentication-to-github#githubs-token-formats
+        #
+        # Test if we're actually logged in, but skip this check for some token prefixes
+        SKIPPED_TOKEN_PREFIXES = ['ghs_']
+        if password or (login_token and not any(login_token.startswith(prefix) for prefix in SKIPPED_TOKEN_PREFIXES)):
             gh_obj.me()
     except github3.exceptions.AuthenticationFailed as e:
         module.fail_json(msg='Failed to connect to GitHub: %s' % to_native(e),
                          details="Please check username and password or token "
                                  "for repository %s" % repo)
+    except github3.exceptions.GitHubError as e:
+        module.fail_json(msg='GitHub API error: %s' % to_native(e),
+                         details="Please check username and password or token "
+                                 "for repository %s" % repo)
 
     repository = gh_obj.repository(user, repo)