[FEATURE] Support GitHub App authentication for `databricks_git_credential` in Terraform about terraform-provider-databricks

[NiklasA]

Hi @alexott , sorry to bother you, do you already have a timeline for the implementation? Thanks in advance, and best regards!

[alexott]

It most probably requires APIs that will be used by Terraform. We don't have it yet

[mgyucht]

@NiklasA Authentication is typically configured at the provider "databricks" level. Syntactically, it seems like you're describing a flow where a user would first provision a Github App and then use those credentials to configure the provider itself:

provider databricks {
  github_app_id = ...
  github_private_key = ...
  github_installation_id = ...
}

Am I understanding this right?

To make authentication easier, we are adopting Open ID Connect, which allows users to authenticate from Github Actions to Databricks without setting up long-lived secrets. To use this, you will need to configure only the host and client ID (account ID as well for account-level provider). You would then add the permission id-token: write to your GH action. This works as long as you are using Github Actions when deploying Terraform. Would that work for you?

[NiklasA]

Hello @mgyucht,

we organize our notebooks within distinct GitHub repositories, each corresponding to different data products. Our goal is to automate the Databricks configuration entirely using Terraform. Specifically, we want to set up databricks_repo resources that automatically sync with our GitHub repositories during the terraform apply phase. However, we encounter a limitation: The current Terraform provider version supports authentication only through GitHub personal access tokens and not via GitHub Apps. I hope this clarification helps to illustrate our use case.