Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Introduce new pattern of Github PAT usage for #2641 #22177

Merged

Conversation

Mykyta-Serbynevskyi
Copy link
Contributor

@Mykyta-Serbynevskyi Mykyta-Serbynevskyi commented Jan 31, 2023

As per #2641 updating GH workflows in cloud repo to reflect changes in PAT usage

The following naming pattern is introduced - GH_PAT_<role>_<repo>

Proposed changes:

previous PAT names proposed PAT names
OSS_BUILD_RUNNER_GITHUB_PAT GH_PAT_BUILD_RUNNER_OSS
CLOUD_BUILD_RUNNER_GITHUB_PAT GH_PAT_BUILD_RUNNER_CLOUD
SUPERTOPHER_PAT GH_PAT_BUILD_RUNNER_BACKUP
OCTAVIA_APPROVINGTON_APPROVAL_PAT GH_PAT_APPROVINGTON_OCTAVIA
AIRBYTEIO_PAT GH_PAT_MAINTENANCE_OSS
DAVINCHIA_PAT GH_PAT_MAINTENANCE_CLOUD
OCTAVIA_PAT GH_PAT_MAINTENANCE_OCTAVIA
OCTAVIA_4_ROOT_ACCESS GH_PAT_ROOT_ACCESS_OCTAVIA

Comments:

  • All new GH_PAT_* tokens are already created on org level and ready for use, all their repository access is preserved.
  • SUPERTOPHER_PAT was chosen to be a backup PAT for start/stop aws instances both in OSS and Cloud repo.
  • OCTAVIA_4_ROOT_ACCESS pat is too permission excessive (x-oauth-scopes: admin:enterprise, admin:org, admin:org_hook, admin:repo_hook, delete:packages, gist, notifications, project, repo, user, workflow, write:discussion, write:packages) that's why it is proposed not to use this token in our workflows and use it only as last resport and in exceptional cases.
  • OCTAVIA_PAT has broader permissions comparing to AIRBYTEIO_PAT/DAVINCHIA_PAT that's why it can be used to work with labeling & slash commands workflows.

@Mykyta-Serbynevskyi Mykyta-Serbynevskyi temporarily deployed to more-secrets January 31, 2023 22:07 — with GitHub Actions Inactive
@Mykyta-Serbynevskyi Mykyta-Serbynevskyi temporarily deployed to more-secrets January 31, 2023 22:07 — with GitHub Actions Inactive
@github-actions
Copy link
Contributor

Airbyte Code Coverage

There is no coverage information present for the Files changed

Total Project Coverage 24.51%

@Mykyta-Serbynevskyi Mykyta-Serbynevskyi force-pushed the mserbynevskyi/2641-pat-usage-refactoring branch from ead202a to 8665fcf Compare January 31, 2023 22:50
@Mykyta-Serbynevskyi Mykyta-Serbynevskyi changed the title introduce new pattern of GH PAT usage for #2641 Introduce new pattern of Github PAT usage for #2641 Jan 31, 2023
@Mykyta-Serbynevskyi Mykyta-Serbynevskyi temporarily deployed to more-secrets January 31, 2023 22:52 — with GitHub Actions Inactive
@Mykyta-Serbynevskyi Mykyta-Serbynevskyi temporarily deployed to more-secrets January 31, 2023 22:52 — with GitHub Actions Inactive
@Mykyta-Serbynevskyi Mykyta-Serbynevskyi requested review from a team January 31, 2023 22:56
@Mykyta-Serbynevskyi Mykyta-Serbynevskyi self-assigned this Jan 31, 2023
@Mykyta-Serbynevskyi Mykyta-Serbynevskyi marked this pull request as ready for review January 31, 2023 22:56
@Mykyta-Serbynevskyi Mykyta-Serbynevskyi force-pushed the mserbynevskyi/2641-pat-usage-refactoring branch from 8665fcf to 6bc7186 Compare February 1, 2023 11:16
@Mykyta-Serbynevskyi Mykyta-Serbynevskyi temporarily deployed to more-secrets February 1, 2023 11:19 — with GitHub Actions Inactive
@Mykyta-Serbynevskyi Mykyta-Serbynevskyi temporarily deployed to more-secrets February 1, 2023 11:19 — with GitHub Actions Inactive
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants