jenkins-github-oauth.groovy

// SecurityRealm
import jenkins.model.Jenkins
import hudson.security.SecurityRealm
import org.jenkinsci.plugins.GithubSecurityRealm

clientID = null
clientSecret = null
securityRealm = null

// secret sanity check
def setSecrets(def secretFile) {
    def secret = new File(secretFile)
    if (secret.exists()) {
        def lines = secret.readLines()
        if (lines.size() < 2) {
            throw new Exception("Secret file doesn't have enough lines. Supposed to have two (clientID and clientSecret).")
        }
        clientID = lines.get(0)
        clientSecret = lines.get(1)
    } else {
        throw new Exception("Secret file ${secretFileName}")
    }
}

setSecrets('/etc/jenkins-secrets/github-client-auth')
securityRealm = new GithubSecurityRealm('https://github.com', 'https://api.github.com', clientID, clientSecret, 'read:org')

//check for equality, no need to modify the runtime if no settings changed
if(!securityRealm.equals(Jenkins.instance.getSecurityRealm())) {
    Jenkins.instance.setSecurityRealm(securityRealm)
    Jenkins.instance.save()
}