Fix authorization for continuous integration.

The credentials must be explicitly refreshed for pushing to
the repository on the Go branch.

PiperOrigin-RevId: 268589817

kokoro/go.cfg

@@ -1,5 +1,19 @@
 build_file: "repo/scripts/go.sh"
 
+before_action {
+  fetch_keystore {
+    keystore_resource {
+      keystore_config_id: 73898
+      keyname: "kokoro-github-access-token"
+    }
+  }
+}
+
+env_vars {
+  key: "KOKORO_GITHUB_ACCESS_TOKEN"
+  value: "$KOKORO_ROOT/src/keystore/73898_kokoro-github-access-token"
+}
+
 env_vars {
   key: "KOKORO_GO_PUSH"
   value: "true"

scripts/go.sh

@@ -30,5 +30,14 @@ go build ./...
 
 # Push, if required.
 if [[ "${KOKORO_GO_PUSH}" == "true" ]]; then
+  if [[ -v KOKORO_GITHUB_ACCESS_TOKEN ]]; then
+    git config --global credential.helper cache
+    git credential approve <<EOF
+protocol=https
+host=github.com
+username=$(cat "${KOKORO_GITHUB_ACCESS_TOKEN}")
+password=x-oauth-basic
+EOF
+  fi
   git push origin go:go
 fi