feat!: Add OIDC authentication support to `PrivateRegistries` by mkushakov · Pull Request #4159 · google/go-github

mkushakov · 2026-04-16T11:32:14Z

BREAKING CHANGE: PrivateRegistriesService is updated to API version 2026-03-10 with struct and response changes.

Update the PrivateRegistriesService to align with the GitHub Private Registries
API version 2026-03-10.

Changes:

Add PrivateRegistryAuthType type with constants for token, username_password,
oidc_azure, oidc_aws, and oidc_jfrog
Add OIDC-related fields to CreateOrganizationPrivateRegistry and
UpdateOrganizationPrivateRegistry: AuthType, TenantID, ClientID,
AwsRegion, AccountID, RoleName, Domain, DomainOwner,
JfrogOidcProviderName, Audience, IdentityMappingName
Add ReplacesBase field to both Create and Update request structs
Add SelectedRepositoryIDs field to PrivateRegistry response struct
Change EncryptedValue and KeyID in CreateOrganizationPrivateRegistry
to *string with omitempty (should be omitted for OIDC auth types)
Change UpdateOrganizationPrivateRegistry() to return (*Response, error)
since the API now returns 204 No Content

API docs: https://docs.github.com/rest/private-registries/organization-configurations?apiVersion=2026-03-10

Fixes: #4158.

google-cla · 2026-04-16T11:32:19Z

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

codecov · 2026-04-16T12:19:18Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.83%. Comparing base (cd716ed) to head (b15fc0c).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4159      +/-   ##
==========================================
- Coverage   93.83%   93.83%   -0.01%     
==========================================
  Files         209      209              
  Lines       19685    19681       -4     
==========================================
- Hits        18472    18468       -4     
  Misses       1015     1015              
  Partials      198      198

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

mkushakov · 2026-04-16T13:31:49Z

@gmlewis thanks for initial review, but this PR is breaking change compared to master branch, not to latest release, since github/private_registries.go was introduced recently and was not yet released #4147
this is why it will be better to merge it before release, to avoid breaking changes

gmlewis

Thank you, @mkushakov!
This is the first GitHub v3 API version breaking change using their new "calendar-versioning" mechanism. As a result, we need to make some more changes in this PR.

According to our README.md:

### Calendar Versioning ###

As of 2022-11-28, GitHub has announced (broken link)
that they are starting to version their v3 API based on "calendar-versioning".

In practice, our goal is to make per-method version overrides (at
least in the core library) rare and temporary.

Our understanding of the GitHub docs is that they will be revving the
entire API to each new date-based version, even if only a few methods
have breaking changes. Other methods will accept the new version with
their existing functionality. So when a new date-based version of the
GitHub API is released, we (the repo maintainers) plan to:

* update each method that had breaking changes, overriding their
  per-method API version header. This may happen in one or multiple
  commits and PRs, and is all done in the main branch.

* once all of the methods with breaking changes have been updated,
  have a final commit that bumps the default API version, and remove
  all of the per-method overrides. That would now get a major version
  bump when the next go-github release is made.

So we need to override the per-method API version header in this PR according to the blog post, and I'm discovering that the blog post link is now broken.
The new link is:
https://github.blog/developer-skills/github/to-infinity-and-beyond-enabling-the-future-of-githubs-rest-api-with-api-versioning/

According to the blog post, the following header needs to be added to the updated endpoint:

X-GitHub-Api-Version: 2026-03-10

So this endpoint needs to add:

req.Header.Set(headerAPIVersion, "2026-03-10")

…e registry models

…ing private registries

…ry requests

Not-Dhananjay-Mishra · 2026-04-16T16:15:03Z

@@ -61,6 +72,8 @@
 	UpdatedAt *Timestamp `json:"updated_at,omitempty"`
 	// Visibility is the visibility of the private registry. Possible values are: "private", "all", and "selected".
 	Visibility *PrivateRegistryVisibility `json:"visibility,omitempty"`
+	// SelectedRepositoryIDs is an array of repository IDs that can access the organization private registry.
+	SelectedRepositoryIDs []int64 `json:"selected_repository_ids,omitempty"`


It has few more missing fields according to response schema -
url, replaces_base, tenant_id, client_id, aws_region, account_id, role_name, domain, domain_owner, jfrog_oidc_provider_name, audience, identity_mapping_name

{ "title": "Organization private registry", "description": "Private registry configuration for an organization", "type": "object", "properties": { "name": { "description": "The name of the private registry configuration.", "type": "string" }, "registry_type": { "description": "The registry type.", "enum": [ "maven_repository", "nuget_feed", "goproxy_server", "npm_registry", "rubygems_server", "cargo_registry", "composer_repository", "docker_registry", "git_source", "helm_registry", "hex_organization", "hex_repository", "pub_repository", "python_index", "terraform_registry" ], "type": "string" }, "auth_type": { "description": "The authentication type for the private registry.", "enum": [ "token", "username_password", "oidc_azure", "oidc_aws", "oidc_jfrog" ], "type": "string" }, "url": { "description": "The URL of the private registry.", "type": "string", "format": "uri" }, "username": { "description": "The username to use when authenticating with the private registry.", "type": "string" }, "replaces_base": { "description": "Whether this private registry replaces the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When `true`, Dependabot will only use this registry and will not fall back to the public registry. When `false` (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages.", "type": "boolean", "default": false }, "visibility": { "description": "Which type of organization repositories have access to the private registry. `selected` means only the repositories specified by `selected_repository_ids` can access the private registry.", "enum": [ "all", "private", "selected" ], "type": "string" }, "selected_repository_ids": { "type": "array", "description": "An array of repository IDs that can access the organization private registry when `visibility` is set to `selected`.", "items": { "type": "integer" } }, "tenant_id": { "description": "The tenant ID of the Azure AD application.", "type": "string" }, "client_id": { "description": "The client ID of the Azure AD application.", "type": "string" }, "aws_region": { "description": "The AWS region.", "type": "string" }, "account_id": { "description": "The AWS account ID.", "type": "string" }, "role_name": { "description": "The AWS IAM role name.", "type": "string" }, "domain": { "description": "The CodeArtifact domain.", "type": "string" }, "domain_owner": { "description": "The CodeArtifact domain owner.", "type": "string" }, "jfrog_oidc_provider_name": { "description": "The JFrog OIDC provider name.", "type": "string" }, "audience": { "description": "The OIDC audience.", "type": "string" }, "identity_mapping_name": { "description": "The JFrog identity mapping name.", "type": "string" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" } }, "required": [ "name", "registry_type", "visibility", "created_at", "updated_at" ] }

Not-Dhananjay-Mishra · 2026-04-16T16:25:56Z

 	// Name of the private registry.
 	Name *string `json:"name,omitempty"`
 	// RegistryType is the type of private registry. You can find the list of supported types in PrivateRegistryType.
 	RegistryType *string `json:"registry_type,omitempty"`


Should we change it's type from *string to *PrivateRegistryType

Not-Dhananjay-Mishra · 2026-04-16T16:30:01Z

 type CreateOrganizationPrivateRegistry struct {
 	// RegistryType is the type of private registry.
 	// You can find the list of supported types in PrivateRegistryType.
 	RegistryType string `json:"registry_type"`


Should we change it's type from string to PrivateRegistryType

Not-Dhananjay-Mishra · 2026-04-16T16:37:26Z

+		RoleName:    Ptr("my-role"),
+		Domain:      Ptr("my-domain"),
+		DomainOwner: Ptr("123456789012"),
+		Audience:    Ptr("sts.amazonaws.com"),


Use example.com instead of random URLs

Not-Dhananjay-Mishra · 2026-04-16T16:37:43Z

+
+	input := &CreateOrganizationPrivateRegistry{
+		RegistryType:          "npm_registry",
+		URL:                   "https://my.jfrog.io/artifactory/api/npm/npm-remote",


Not-Dhananjay-Mishra · 2026-04-16T16:38:34Z

+
+	input := &CreateOrganizationPrivateRegistry{
+		RegistryType:          "maven_repository",
+		URL:                   "https://maven.pkg.github.com/OWNER/REPOSITORY",


gmlewis changed the title ~~feat: Add OIDC authentication support to PrivateRegistries~~ feat: Add OIDC authentication support to PrivateRegistries Apr 16, 2026

gmlewis added the NeedsReview PR is awaiting a review before merging. label Apr 16, 2026

gmlewis changed the title ~~feat: Add OIDC authentication support to PrivateRegistries~~ feat!: Add OIDC authentication support to PrivateRegistries Apr 16, 2026

gmlewis added the Breaking API Change PR will require a bump to the major version num in next release. Look here to see the change(s). label Apr 16, 2026

gmlewis requested changes Apr 16, 2026

View reviewed changes

gmlewis mentioned this pull request Apr 16, 2026

docs: Fix broken blog post link #4160

Merged

mkushakov added 3 commits April 16, 2026 16:25

feat(private-registry): add OIDC support and related fields in privat…

00cae6c

…e registry models

feat(private-registry): add OIDC support tests for creating and updat…

99af94b

…ing private registries

feat(private-registry): add API versioning support for private regist…

b15fc0c

…ry requests

mkushakov force-pushed the feat/private-registry-oidc-support branch from c4bdd0e to b15fc0c Compare April 16, 2026 14:25

Not-Dhananjay-Mishra reviewed Apr 16, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat!: Add OIDC authentication support to `PrivateRegistries`#4159

feat!: Add OIDC authentication support to `PrivateRegistries`#4159
mkushakov wants to merge 3 commits intogoogle:masterfrom
mkushakov:feat/private-registry-oidc-support

mkushakov commented Apr 16, 2026 •

edited by gmlewis

Loading

Uh oh!

google-cla bot commented Apr 16, 2026

Uh oh!

codecov bot commented Apr 16, 2026 •

edited

Loading

Uh oh!

mkushakov commented Apr 16, 2026 •

edited

Loading

Uh oh!

gmlewis left a comment

Uh oh!

Not-Dhananjay-Mishra Apr 16, 2026

Uh oh!

Not-Dhananjay-Mishra Apr 16, 2026

Uh oh!

Not-Dhananjay-Mishra Apr 16, 2026

Uh oh!

Not-Dhananjay-Mishra Apr 16, 2026

Uh oh!

Not-Dhananjay-Mishra Apr 16, 2026

Uh oh!

Not-Dhananjay-Mishra Apr 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

mkushakov commented Apr 16, 2026 • edited by gmlewis Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

google-cla bot commented Apr 16, 2026

Uh oh!

codecov bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

mkushakov commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gmlewis left a comment

Choose a reason for hiding this comment

Uh oh!

Not-Dhananjay-Mishra Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Not-Dhananjay-Mishra Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Not-Dhananjay-Mishra Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Not-Dhananjay-Mishra Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Not-Dhananjay-Mishra Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Not-Dhananjay-Mishra Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mkushakov commented Apr 16, 2026 •

edited by gmlewis

Loading

codecov bot commented Apr 16, 2026 •

edited

Loading

mkushakov commented Apr 16, 2026 •

edited

Loading