使用Ansible结合Git Token读取GitHub文件失败，求正确方案

问题描述 #

尝试用Ansible任务读取GitHub仓库GITHUB_XXXX中的file.py文件，但无法获取实际内容。已确认仓库读取权限配置正常，问题仍存在，需要正确的实现方法。

当前Playbook代码 #

---
- name: Read file from GitHub
  hosts: localhost
  gather_facts: false
  vars:
    github_user: "soonxxx"
    repository: "GITHUB_xxxxx"
    file_path: "file.py"
    github_token: "ghp_dXG"

  tasks:
    - name: Fetch file from GitHub
      uri:
        url: "https://raw.githubusercontent.com/soonXXXX/GITHUB_XXXXX/main/file.py"
        method: GET
        headers:
          Authorization: "token {{ github_token }}"
        return_content: true
        force_basic_auth: true
        status_code: 200
      register: file_contents

    - name: Store file content to variable
      set_fact:
        my_variable: "{{ file_contents.content | b64decode }}"

执行错误信息 #

{"accept_ranges": "bytes", "access_control_allow_origin": "*", "changed": false, "connection": "close", "content": "404: Not Found", "content_length": "14", "content_security_policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox", "content_type": "text/plain; charset=utf-8", "cross_origin_resource_policy": "cross-origin", "date": "Thu, 28 Mar 2024 21:45:32 GMT", "elapsed": 0, "expires": "Thu, 28 Mar 2024 21:50:32 GMT", "msg": "Status code was 404 and not [200]: HTTP Error 404: Not Found", "redirected": false, "source_age": "0", "status": 404, "strict_transport_security": "max-age=31536000", "url": "https://raw.githubusercontent.com/soonxxxx/GITHUB_xxxxx/main/file.py", "vary": "Authorization,Accept-Encoding,Origin", "via": "1.1 varnish", "x_cache": "MISS", "x_cache_hits": "0", "x_content_type_options": "nosniff", "x_fastly_request_id": "13ad8711f515500b0be10b9b8c427f2f60384a42", "x_frame_options": "deny", "x_github_request_id": "9488:123E83:7DB4F:8DDBA:6605E4FC", "x_served_by": "cache-ewr18143-EWR", "x_timer": "S1711662332.486123,VS0,VE28", "x_xss_protection": "1; mode=block"}

期望结果：获取Git仓库GITHUB_XXXXX中file.py的实际内容。

问题分析与解决方案 #

1. 核心问题定位 #

404错误说明URL指向的资源不存在，先确认三个关键信息：

• 用户名、仓库名是否完全匹配（GitHub对仓库名大小写敏感）
• 文件路径是否正确，包括分支名（当前用的是main，确认仓库默认分支是否为main，而非master或其他分支）
• 文件是否确实存在于指定分支的对应路径下

2. 修正认证逻辑 #

raw.githubusercontent.com的认证规范需要调整：

• 替换Authorization头格式：用Bearer {{ github_token }}代替token {{ github_token }}
• 移除force_basic_auth: true，该参数会将token作为基础认证密码，不符合GitHub的Bearer认证要求

3. 移除不必要的解码 #

返回的文件内容是明文，无需b64decode处理，直接使用file_contents.content即可。

修正后的Playbook #

---
- name: Read file from GitHub
  hosts: localhost
  gather_facts: false
  vars:
    github_user: "soonxxx"
    repository: "GITHUB_xxxxx"
    file_path: "file.py"
    github_token: "ghp_dXG"
    github_branch: "main"  # 确认分支名正确

  tasks:
    - name: Fetch file from GitHub
      uri:
        url: "https://raw.githubusercontent.com/{{ github_user }}/{{ repository }}/{{ github_branch }}/{{ file_path }}"
        method: GET
        headers:
          Authorization: "Bearer {{ github_token }}"
        return_content: true
        status_code: 200
      register: file_contents

    - name: Store file content to variable
      set_fact:
        my_variable: "{{ file_contents.content }}"

    - name: Verify content
      debug:
        var: my_variable

额外验证步骤 #

• 用curl手动测试修正后的URL，确认能返回内容：

  curl -H "Authorization: Bearer ghp_dXG" https://raw.githubusercontent.com/soonxxx/GITHUB_xxxxx/main/file.py
  

• 确认GitHub token已授予仓库读取权限（repo权限），且未过期、未被撤销

内容的提问来源于stack exchange，提问作者Sravan Nekkanti