fail if both private key and key path are provided.

added a comment to clarify how the private key should be encoded

Author: kommendorkapten

internal/controller/config.go

@@ -20,10 +20,12 @@ type Config struct {
 	PhysicalEnvironment string
 	Cluster             string
 	//nolint:gosec
-	APIToken            string
-	BaseURL             string
-	GHAppID             string
-	GHInstallID         string
+	APIToken    string
+	BaseURL     string
+	GHAppID     string
+	GHInstallID string
+	// GHAppPrivateKey must be the PEM Encoding of the
+	// private key
 	GHAppPrivateKey     []byte
 	GHAppPrivateKeyPath string
 	Organization        string

pkg/deploymentrecord/client.go

@@ -107,6 +107,10 @@ func WithAPIToken(token string) ClientOption {
 // If an API token is also set, the GitHub App will take precedence.
 func WithGHApp(id, installID string, pkBytes []byte, pkPath string) ClientOption {
 	return func(c *Client) {
+		if len(pkBytes) > 0 && pkPath != "" {
+			panic("both GitHub App private key and private key path are set")
+		}
+
 		pid, err := strconv.Atoi(id)
 		if err != nil {
 			panic(err)