Support using agent yamls from private github repos

dgageot · dgageot · commit 95ff03888c63 · 2026-02-04T18:37:28.000+01:00
Signed-off-by: David Gageot &lt;david.gageot@docker.com&gt;
diff --git a/cmd/root/api.go b/cmd/root/api.go
@@ -141,7 +141,7 @@ func (f *apiFlags) runAPICommand(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("creating session store: %w", err)
 	}
 
-	sources, err := config.ResolveSources(agentsPath)
+	sources, err := config.ResolveSources(agentsPath, f.runConfig.EnvProvider())
 	if err != nil {
 		return fmt.Errorf("resolving agent sources: %w", err)
 	}
diff --git a/cmd/root/completion.go b/cmd/root/completion.go
@@ -52,7 +52,7 @@ func completeMessage(cmd *cobra.Command, args []string, toComplete string) ([]st
 		return nil, cobra.ShellCompDirectiveNoFileComp
 	}
 
-	agentSource, err := config.Resolve(args[0])
+	agentSource, err := config.Resolve(args[0], nil)
 	if err != nil {
 		return nil, cobra.ShellCompDirectiveNoFileComp
 	}
diff --git a/cmd/root/debug.go b/cmd/root/debug.go
@@ -49,7 +49,7 @@ func (f *debugFlags) runDebugConfigCommand(cmd *cobra.Command, args []string) er
 	ctx := cmd.Context()
 	agentFilename := args[0]
 
-	agentSource, err := config.Resolve(agentFilename)
+	agentSource, err := config.Resolve(agentFilename, f.runConfig.EnvProvider())
 	if err != nil {
 		return err
 	}
@@ -69,7 +69,7 @@ func (f *debugFlags) runDebugToolsetsCommand(cmd *cobra.Command, args []string)
 	agentFilename := args[0]
 	out := cli.NewPrinter(cmd.OutOrStdout())
 
-	agentSource, err := config.Resolve(agentFilename)
+	agentSource, err := config.Resolve(agentFilename, f.runConfig.EnvProvider())
 	if err != nil {
 		return err
 	}
diff --git a/cmd/root/push.go b/cmd/root/push.go
@@ -38,7 +38,7 @@ func runPushCommand(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	agentSource, err := config.Resolve(agentFilename)
+	agentSource, err := config.Resolve(agentFilename, nil)
 	if err != nil {
 		return fmt.Errorf("resolving agent file: %w", err)
 	}
diff --git a/cmd/root/run.go b/cmd/root/run.go
@@ -213,7 +213,7 @@ func (f *runExecFlags) runOrExec(ctx context.Context, out *cli.Printer, args []s
 		}
 		cleanup = func() {} // Remote runtime doesn't need local cleanup
 	} else {
-		agentSource, err := config.Resolve(agentFileName)
+		agentSource, err := config.Resolve(agentFileName, f.runConfig.EnvProvider())
 		if err != nil {
 			return err
 		}
diff --git a/e2e/cagent_mcp_test.go b/e2e/cagent_mcp_test.go
@@ -15,7 +15,7 @@ func TestMCP_SingleAgent(t *testing.T) {
 	t.Parallel()
 
 	ctx := t.Context()
-	agentSource, err := config.Resolve("testdata/basic.yaml")
+	agentSource, err := config.Resolve("testdata/basic.yaml", nil)
 	require.NoError(t, err)
 
 	_, runConfig := startRecordingAIProxy(t)
@@ -38,7 +38,7 @@ func TestMCP_MultiAgent(t *testing.T) {
 	t.Parallel()
 
 	ctx := t.Context()
-	agentSource, err := config.Resolve("testdata/multi.yaml")
+	agentSource, err := config.Resolve("testdata/multi.yaml", nil)
 	require.NoError(t, err)
 
 	_, runConfig := startRecordingAIProxy(t)
diff --git a/e2e/runtime_test.go b/e2e/runtime_test.go
@@ -16,7 +16,7 @@ func TestRuntime_OpenAI_Basic(t *testing.T) {
 	t.Parallel()
 
 	ctx := t.Context()
-	agentSource, err := config.Resolve("testdata/basic.yaml")
+	agentSource, err := config.Resolve("testdata/basic.yaml", nil)
 	require.NoError(t, err)
 
 	_, runConfig := startRecordingAIProxy(t)
@@ -39,7 +39,7 @@ func TestRuntime_Mistral_Basic(t *testing.T) {
 	t.Parallel()
 
 	ctx := t.Context()
-	agentSource, err := config.Resolve("testdata/basic.yaml")
+	agentSource, err := config.Resolve("testdata/basic.yaml", nil)
 	require.NoError(t, err)
 
 	_, runConfig := startRecordingAIProxy(t)
diff --git a/pkg/a2a/adapter_test.go b/pkg/a2a/adapter_test.go
@@ -14,7 +14,7 @@ import (
 func TestNewCAgentAdapter(t *testing.T) {
 	t.Setenv("OPENAI_API_KEY", "DUMMY")
 
-	agentSource, err := config.Resolve("testdata/basic.yaml")
+	agentSource, err := config.Resolve("testdata/basic.yaml", nil)
 	require.NoError(t, err)
 
 	team, err := teamloader.Load(t.Context(), agentSource, &config.RuntimeConfig{})
@@ -33,7 +33,7 @@ func TestNewCAgentAdapter(t *testing.T) {
 func TestNewCAgentAdapter_NonExistent(t *testing.T) {
 	t.Setenv("OPENAI_API_KEY", "DUMMY")
 
-	agentSource, err := config.Resolve("testdata/basic.yaml")
+	agentSource, err := config.Resolve("testdata/basic.yaml", nil)
 	require.NoError(t, err)
 
 	team, err := teamloader.Load(t.Context(), agentSource, &config.RuntimeConfig{})
diff --git a/pkg/a2a/server.go b/pkg/a2a/server.go
@@ -26,7 +26,7 @@ import (
 func Run(ctx context.Context, agentFilename, agentName string, runConfig *config.RuntimeConfig, ln net.Listener) error {
 	slog.Debug("Starting A2A server", "agent", agentName, "addr", ln.Addr().String())
 
-	agentSource, err := config.Resolve(agentFilename)
+	agentSource, err := config.Resolve(agentFilename, nil)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/acp/run.go b/pkg/acp/run.go
@@ -13,7 +13,7 @@ import (
 func Run(ctx context.Context, agentFilename string, stdin io.Reader, stdout io.Writer, runConfig *config.RuntimeConfig) error {
 	slog.Debug("Starting ACP server", "agent", agentFilename)
 
-	agentSource, err := config.Resolve(agentFilename)
+	agentSource, err := config.Resolve(agentFilename, nil)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/build/build.go b/pkg/build/build.go
@@ -31,7 +31,7 @@ type Printer interface {
 }
 
 func DockerImage(ctx context.Context, out Printer, agentFilename, dockerImageName string, opts Options) error {
-	agentSource, err := config.Resolve(agentFilename)
+	agentSource, err := config.Resolve(agentFilename, nil)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/config/resolve.go b/pkg/config/resolve.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/google/go-containerregistry/pkg/name"
 
+	"github.com/docker/cagent/pkg/environment"
 	"github.com/docker/cagent/pkg/reference"
 	"github.com/docker/cagent/pkg/userconfig"
 )
@@ -46,13 +47,15 @@ func GetUserSettings() *userconfig.Settings {
 	return cfg.GetSettings()
 }
 
-// ResolveSources resolves an agent file reference (local file, URL, or OCI image) to sources
-// For OCI references, always checks remote for updates but falls back to local cache if offline
-func ResolveSources(agentsPath string) (Sources, error) {
+// ResolveSources resolves an agent file reference (local file, URL, or OCI image) to sources.
+// If envProvider is non-nil, it will be used to look up GITHUB_TOKEN for authentication
+// when fetching from GitHub URLs.
+// For OCI references, always checks remote for updates but falls back to local cache if offline.
+func ResolveSources(agentsPath string, envProvider environment.Provider) (Sources, error) {
 	// Handle URL references first (before resolve() which converts to absolute path)
 	if IsURLReference(agentsPath) {
 		return map[string]Source{
-			agentsPath: NewURLSource(agentsPath),
+			agentsPath: NewURLSource(agentsPath, envProvider),
 		}, nil
 	}
 
@@ -93,7 +96,7 @@ func ResolveSources(agentsPath string) (Sources, error) {
 				continue
 			}
 			a := filepath.Join(resolvedPath, entry.Name())
-			sources[fileNameWithoutExt(a)], err = Resolve(a)
+			sources[fileNameWithoutExt(a)], err = Resolve(a, envProvider)
 			if err != nil {
 				return nil, err
 			}
@@ -106,9 +109,11 @@ func ResolveSources(agentsPath string) (Sources, error) {
 	}, nil
 }
 
-// Resolve resolves an agent file reference (local file, URL, or OCI image) to a source
-// For OCI references, always checks remote for updates but falls back to local cache if offline
-func Resolve(agentFilename string) (Source, error) {
+// Resolve resolves an agent file reference (local file, URL, or OCI image) to a source.
+// If envProvider is non-nil, it will be used to look up GITHUB_TOKEN for authentication
+// when fetching from GitHub URLs.
+// For OCI references, always checks remote for updates but falls back to local cache if offline.
+func Resolve(agentFilename string, envProvider environment.Provider) (Source, error) {
 	resolvedPath, err := resolve(agentFilename)
 	if err != nil {
 		if IsOCIReference(agentFilename) {
@@ -122,7 +127,7 @@ func Resolve(agentFilename string) (Source, error) {
 	}
 
 	if IsURLReference(resolvedPath) {
-		return NewURLSource(resolvedPath), nil
+		return NewURLSource(resolvedPath, envProvider), nil
 	}
 
 	if isLocalFile(resolvedPath) {
diff --git a/pkg/config/resolve_test.go b/pkg/config/resolve_test.go
@@ -271,7 +271,7 @@ func TestResolveAgentFile_EmptyDirectory(t *testing.T) {
 func TestResolveSources(t *testing.T) {
 	t.Parallel()
 
-	sources, err := ResolveSources("./testdata/v1.yaml")
+	sources, err := ResolveSources("./testdata/v1.yaml", nil)
 	require.NoError(t, err)
 
 	assert.Len(t, sources, 1)
@@ -297,7 +297,7 @@ func TestResolve_DefaultAliasOverride(t *testing.T) {
 	require.NoError(t, cfg.Save())
 
 	// Resolve with "default" should return the aliased file
-	source, err := Resolve("default")
+	source, err := Resolve("default", nil)
 	require.NoError(t, err)
 	assert.Equal(t, agentFile, source.Name())
 
@@ -318,7 +318,7 @@ func TestResolve_DefaultAliasToOCIReference(t *testing.T) {
 	require.NoError(t, cfg.Save())
 
 	// Resolve with "default" should return an OCI source with the aliased reference
-	source, err := Resolve("default")
+	source, err := Resolve("default", nil)
 	require.NoError(t, err)
 	assert.Equal(t, "docker/gordon", source.Name())
 }
@@ -334,7 +334,7 @@ func TestResolveSources_DefaultAliasToOCIReference(t *testing.T) {
 	require.NoError(t, cfg.Save())
 
 	// ResolveSources with "default" should return an OCI source with the aliased reference
-	sources, err := ResolveSources("default")
+	sources, err := ResolveSources("default", nil)
 	require.NoError(t, err)
 	require.Len(t, sources, 1)
 
@@ -363,7 +363,7 @@ func TestResolve_EmptyWithDefaultAliasOverride(t *testing.T) {
 	require.NoError(t, cfg.Save())
 
 	// Resolve with empty string should also use the "default" alias
-	source, err := Resolve("")
+	source, err := Resolve("", nil)
 	require.NoError(t, err)
 	assert.Equal(t, agentFile, source.Name())
 
@@ -392,7 +392,7 @@ func TestResolveSources_DefaultAliasOverride(t *testing.T) {
 	require.NoError(t, cfg.Save())
 
 	// ResolveSources with "default" should return the aliased file
-	sources, err := ResolveSources("default")
+	sources, err := ResolveSources("default", nil)
 	require.NoError(t, err)
 	require.Len(t, sources, 1)
 
@@ -425,7 +425,7 @@ func TestResolveSources_EmptyWithDefaultAliasOverride(t *testing.T) {
 	require.NoError(t, cfg.Save())
 
 	// ResolveSources with empty string should also use the "default" alias
-	sources, err := ResolveSources("")
+	sources, err := ResolveSources("", nil)
 	require.NoError(t, err)
 	require.Len(t, sources, 1)
 
diff --git a/pkg/config/sources.go b/pkg/config/sources.go
@@ -14,6 +14,7 @@ import (
 	"strings"
 
 	"github.com/docker/cagent/pkg/content"
+	"github.com/docker/cagent/pkg/environment"
 	"github.com/docker/cagent/pkg/httpclient"
 	"github.com/docker/cagent/pkg/paths"
 	"github.com/docker/cagent/pkg/remote"
@@ -174,12 +175,16 @@ func (a ociSource) Read(ctx context.Context) ([]byte, error) {
 
 // urlSource is used to load an agent configuration from an HTTP/HTTPS URL.
 type urlSource struct {
-	url string
+	url         string
+	envProvider environment.Provider
 }
 
-func NewURLSource(url string) Source {
-	return urlSource{
-		url: url,
+// NewURLSource creates a new URL source. If envProvider is non-nil, it will be used
+// to look up GITHUB_TOKEN for authentication when fetching from GitHub URLs.
+func NewURLSource(url string, envProvider environment.Provider) Source {
+	return &urlSource{
+		url:         url,
+		envProvider: envProvider,
 	}
 }
 
@@ -218,6 +223,9 @@ func (a urlSource) Read(ctx context.Context) ([]byte, error) {
 		req.Header.Set("If-None-Match", cachedETag)
 	}
 
+	// Add GitHub token authorization for GitHub URLs
+	a.addGitHubAuth(ctx, req)
+
 	resp, err := httpclient.NewHTTPClient().Do(req)
 	if err != nil {
 		// Network error - try to use cached version
@@ -272,6 +280,45 @@ func (a urlSource) Read(ctx context.Context) ([]byte, error) {
 	return data, nil
 }
 
+// githubHosts lists the hostnames that support GitHub token authentication.
+var githubHosts = []string{
+	"github.com",
+	"raw.githubusercontent.com",
+	"gist.githubusercontent.com",
+}
+
+// isGitHubURL checks if the URL is a GitHub URL that can use token authentication.
+func isGitHubURL(url string) bool {
+	for _, host := range githubHosts {
+		if strings.Contains(url, host) {
+			return true
+		}
+	}
+	return false
+}
+
+// addGitHubAuth adds GitHub token authorization to the request if:
+// - The URL is a GitHub URL
+// - An environment provider is configured
+// - GITHUB_TOKEN is available in the environment
+func (a urlSource) addGitHubAuth(ctx context.Context, req *http.Request) {
+	if a.envProvider == nil {
+		return
+	}
+
+	if !isGitHubURL(a.url) {
+		return
+	}
+
+	token, ok := a.envProvider.Get(ctx, "GITHUB_TOKEN")
+	if !ok || token == "" {
+		return
+	}
+
+	req.Header.Set("Authorization", "Bearer "+token)
+	slog.Debug("Added GitHub token authorization to request", "url", a.url)
+}
+
 // hashURL creates a safe filename from a URL.
 func hashURL(url string) string {
 	h := sha256.Sum256([]byte(url))
diff --git a/pkg/config/sources_test.go b/pkg/config/sources_test.go
diff --git a/pkg/evaluation/eval.go b/pkg/evaluation/eval.go
diff --git a/pkg/mcp/server.go b/pkg/mcp/server.go
diff --git a/pkg/oci/package_test.go b/pkg/oci/package_test.go
diff --git a/pkg/server/server_test.go b/pkg/server/server_test.go
diff --git a/pkg/teamloader/teamloader_test.go b/pkg/teamloader/teamloader_test.go

Original file line number	Diff line number	Diff line change
`@@ -141,7 +141,7 @@ func (f apiFlags) runAPICommand(cmd cobra.Command, args []string) error {`
`141`	`141`	`return fmt.Errorf("creating session store: %w", err)`
`142`	`142`	`}`
`143`	`143`
`144`		`- sources, err := config.ResolveSources(agentsPath)`
	`144`	`+ sources, err := config.ResolveSources(agentsPath, f.runConfig.EnvProvider())`
`145`	`145`	`if err != nil {`
`146`	`146`	`return fmt.Errorf("resolving agent sources: %w", err)`
`147`	`147`	`}`
Original file line number	Diff line number	Diff line change
`@@ -52,7 +52,7 @@ func completeMessage(cmd *cobra.Command, args []string, toComplete string) ([]st`
`52`	`52`	`return nil, cobra.ShellCompDirectiveNoFileComp`
`53`	`53`	`}`
`54`	`54`
`55`		`- agentSource, err := config.Resolve(args[0])`
	`55`	`+ agentSource, err := config.Resolve(args[0], nil)`
`56`	`56`	`if err != nil {`
`57`	`57`	`return nil, cobra.ShellCompDirectiveNoFileComp`
`58`	`58`	`}`
Original file line number	Diff line number	Diff line change
`@@ -38,7 +38,7 @@ func runPushCommand(cmd *cobra.Command, args []string) error {`
`38`	`38`	`return err`
`39`	`39`	`}`
`40`	`40`
`41`		`- agentSource, err := config.Resolve(agentFilename)`
	`41`	`+ agentSource, err := config.Resolve(agentFilename, nil)`
`42`	`42`	`if err != nil {`
`43`	`43`	`return fmt.Errorf("resolving agent file: %w", err)`
`44`	`44`	`}`
Original file line number	Diff line number	Diff line change
`@@ -213,7 +213,7 @@ func (f runExecFlags) runOrExec(ctx context.Context, out cli.Printer, args []s`
`213`	`213`	`}`
`214`	`214`	`cleanup = func() {} // Remote runtime doesn't need local cleanup`
`215`	`215`	`} else {`
`216`		`- agentSource, err := config.Resolve(agentFileName)`
	`216`	`+ agentSource, err := config.Resolve(agentFileName, f.runConfig.EnvProvider())`
`217`	`217`	`if err != nil {`
`218`	`218`	`return err`
`219`	`219`	`}`
Original file line number	Diff line number	Diff line change
`@@ -26,7 +26,7 @@ import (`
`26`	`26`	`func Run(ctx context.Context, agentFilename, agentName string, runConfig *config.RuntimeConfig, ln net.Listener) error {`
`27`	`27`	`slog.Debug("Starting A2A server", "agent", agentName, "addr", ln.Addr().String())`
`28`	`28`
`29`		`- agentSource, err := config.Resolve(agentFilename)`
	`29`	`+ agentSource, err := config.Resolve(agentFilename, nil)`
`30`	`30`	`if err != nil {`
`31`	`31`	`return err`
`32`	`32`	`}`
Original file line number	Diff line number	Diff line change
`@@ -13,7 +13,7 @@ import (`
`13`	`13`	`func Run(ctx context.Context, agentFilename string, stdin io.Reader, stdout io.Writer, runConfig *config.RuntimeConfig) error {`
`14`	`14`	`slog.Debug("Starting ACP server", "agent", agentFilename)`
`15`	`15`
`16`		`- agentSource, err := config.Resolve(agentFilename)`
	`16`	`+ agentSource, err := config.Resolve(agentFilename, nil)`
`17`	`17`	`if err != nil {`
`18`	`18`	`return err`
`19`	`19`	`}`