Add to public github repo with lower perms

[jbenet]

When adding AppVeyor, I see:

Repository webhooks and services
Admin access
This application will have full access to repository webhooks and services (no direct code access).

"full access to repository webhooks and services" gives full access to all other services, including credentials. For anyone remotely security conscious this is unacceptable. We know it's likely a github problem-- It is no secret that github's OAuth permissions are as granular as icebergs. (Though they do seem to be getting better...). Sill, there should be a recommended way to add appveyor as a CI service manually, for those of us who care.

[jbenet]

I tried adding AppVeyor as just a git repo, that seems to work for getting the code. I get a webhook url, and that seems to trigger the builds, even on PR branches. (though the pr branch still builds as master: see https://ci.appveyor.com/project/ipfsbot/go-ipfs/history -- which is failing because master does not include appveyor.yml, even though the branch does).

The other problem is this is not setting the commit indicator. How can we set the commit indicator? (again, this is manual as we cannot grant appveyor permission to read/write ALL webhook credentials)

[FeodorFitsner]

appveyor.yml is not supported with generic Git repositories and webhook payload is not compatible with GitHub one.

[jbenet]

@FeodorFitsner so how do we do this then?

[FeodorFitsner]

Add it as GitHub repository.

• Feodor

On Tue, Dec 1, 2015 at 9:20 AM, Juan Benet notifications@github.com
wrote:

@FeodorFitsner so how do we do this then?

Reply to this email directly or view it on GitHub:
#527 (comment)

[jbenet]

@FeodorFitsner how can i do that without giving full access to all other repository webhooks + credentials?

[FeodorFitsner]

Create a new GitHub user account, give access to that specific repo only and then use this account within AppVeyor.

[jbenet]

misunderstanding the point, AppVeyor would get access to other webhooks + credentials on the exact same repo

[FeodorFitsner]

OK, right. Let's keep this issue open then - we might re-visit flow for adding public GitHub repos in the future.

[jbenet]

@FeodorFitsner is there any way you could add us manually? we want to use AppVeyor :(

[FeodorFitsner]

OK, another "idea"! Register new GitHub account, then create an empty "fake" public repository under it. Go to AppVeyor, authorize with that account, add that fake repository then go to added Project settings and update repository name (owner/name) on General tab. Configure webhook manually on real repo.

[jbenet]

@FeodorFitsner ok thank you for bearing with me, did that:

• registered github.com/ipfs-integrations
• created github.com/ipfs-integrations/test
• added to appveyor's IPFSBOT account (authorized)
• re-pointed appveyor's project to "ipfs/go-ipfs"
• manually copied the webhook from github.com/ipfs-integrations/test to github.com/ipfs/go-ipfs
• pushed to branch for Add appveyor conf ipfs/kubo#1982

And I got the webhook to trigger right on the PR! \o/ https://ci.appveyor.com/project/ipfsbot/test/history

Remaining Problem: commit indicators still does not show appveyor:

FWIW, the webhook "ipfs-integrations/test" was just a "Webhook", not a "Service". other indicators (like travis) are "Service". Is this a supported feature for app-veyor? is there anything special done with github?

[FeodorFitsner]

That bot user should have write access to add commit status.

[jbenet]

@FeodorFitsner thanks very much! great success! -- i'll leave the issue open since this should become easier for other users.

[FeodorFitsner]

Cool, thanks for the update! :)

[IgorMinar]

Just a note that Appveyor should be asking only for repo:status OAuth Scope for updating status. Full write permission is not needed for status updates.

From https://developer.github.com/v3/repos/statuses/:

Note that the repo:status OAuth scope grants targeted access to Statuses without also granting access to repository code, while the repo scope grants permission to code as well as statuses.

[FeodorFitsner]

Currently, it's asking for read:org,admin:repo_hook,repo:status if "Public repositories" selected and just repo if "Public and private repositories" selected.

[le-appveyor]

Thanks for the workaround (this is the bot account I created for it) - but could you, possibly, just not have such aggressive permission requests? It's been over a year.

[rtibbles]

Would be highly appreciated!

[oberstet]

so how does it work? this is a bummer, and I'm afraid I'm forced to look elsewhere ..

[FeodorFitsner]

I'm closing the issue in favor of GitHub Apps item.