deployclient: add support for auto-renewing github tokens

[tronghn]

Fixes #229.

[Copilot]

Pull Request Overview

This pull request adds support for auto-renewing GitHub tokens by introducing a new interceptor and updating configuration and connection logic.

• Added a GitHubTokenInterceptor in the gRPC auth package to automatically fetch and renew tokens.
• Updated configuration flags to deprecate the old GitHub token and add separate fields for the token URL and bearer token.
• Modified the gRPC connection setup to select the appropriate interceptor based on available GitHub authentication parameters.

Reviewed Changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
pkg/grpc/interceptor/auth/client.go	Introduces GitHubTokenInterceptor with token renewal logic.
pkg/deployclient/config.go	Renames GithubToken to GitHubToken and adds new config flags for token URL and bearer token.
pkg/deployclient/grpc.go	Updates interceptor selection based on new GitHub token fields.

Files not reviewed (1)

• actions/deploy/entrypoint.sh: Language not supported

Comments suppressed due to low confidence (1)

pkg/grpc/interceptor/auth/client.go:130

• [nitpick] Consider renaming variable 'j' to a more descriptive name (e.g., 'parsedToken') to improve code clarity.

j, err := jwt.ParseString(tokenResponse.Token,

Pull Request Overview

This pull request introduces support for auto-renewing GitHub tokens for deployments by adding a new interceptor and updating configuration and gRPC connection logic accordingly.

• Added a GitHubTokenInterceptor with token renewal support.
• Updated configuration to favor new GitHub token URL and bearer token flags.
• Modified gRPC connection initialization to prioritize the new token mechanism over the legacy token.

Reviewed Changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
pkg/grpc/interceptor/auth/client.go	Introduces GitHubTokenInterceptor with auto-renewal logic.
pkg/deployclient/config.go	Renames and adds config flags to support new token authentication.
pkg/deployclient/grpc.go	Updates gRPC connection setup to use new GitHub token authentication.

Files not reviewed (1)

• actions/deploy/entrypoint.sh: Language not supported

Comments suppressed due to low confidence (2)

pkg/grpc/interceptor/auth/client.go:132

• [nitpick] Skipping JWT signature verification can expose potential security risks if tokens are used beyond simple expiration checks. Consider documenting the security implications or ensuring that signature verification is performed in environments where it is necessary.

// Skip signature verification; we only care about the expiration time here.

pkg/deployclient/grpc.go:26

• [nitpick] When both new and legacy GitHub token configurations are provided, the new mechanism takes precedence. Consider adding an inline comment to clarify this precedence for future maintainers.

if cfg.GitHubBearerToken != "" && cfg.GitHubTokenURL != "" {