ci: set GITHUB_ACCESS_TOKEN to temporary read only token

.github/workflows/test.yml

@@ -44,6 +44,12 @@ jobs:
   tests:
     runs-on: ubuntu-20.04
     timeout-minutes: 10
+
+    permissions:
+      contents: read
+    env:
+      GITHUB_ACCESS_TOKEN: "${{ secrets.github_token }}"
+
     strategy:
       # keep running so we can see if tests with other k3s/k8s/helm versions pass
       fail-fast: false
@@ -345,6 +351,12 @@ jobs:
   test-local:
     runs-on: ubuntu-20.04
     timeout-minutes: 5
+
+    permissions:
+      contents: read
+    env:
+      GITHUB_ACCESS_TOKEN: "${{ secrets.github_token }}"
+
     steps:
       - uses: actions/checkout@v3
 

binderhub/tests/conftest.py

@@ -119,12 +119,24 @@ def mock_asynchttpclient(request):
     # We have to explicitly load the mock responses we want to use
     # We should use as few mocked responses as possible because it means
     # we won't notice changes in the responses from the host that we are
-    # mocking and our mock responses don't simulate every and all behaviour
+    # mocking and our mock responses don't simulate every and all behavior
     load_mock_responses("www.hydroshare.org")
 
-    if not os.getenv("GITHUB_ACCESS_TOKEN"):
+    token = os.getenv("GITHUB_ACCESS_TOKEN")
+    if not token:
         load_mock_responses("api.github.com")
         load_mock_responses("zenodo.org")
+    if token and token.startswith("ghs-"):
+        # The GitHub Actions provided temporary token (secrets.github_token)
+        # does not have access to api.github.com/gists. Due to this, we mock
+        # such requests even if such token is provided. We recognize them by
+        # being a server-to-server token with a ghs- prefix as compared to for
+        # example a personal access token.
+        #
+        # More about github token prefixes:
+        # https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/#identifiable-prefixes
+        #
+        load_mock_responses("api.github.com.gists")
 
 
 @pytest.fixture

binderhub/tests/http-record.api.github.com.gists.json

@@ -0,0 +1,68 @@
+{
+  "https://api.github.com/gists/8a658f7f63b13768d1e75fa2464f5092": {
+    "body": "{\"url\":\"https://api.github.com/gists/8a658f7f63b13768d1e75fa2464f5092\",\"forks_url\":\"https://api.github.com/gists/8a658f7f63b13768d1e75fa2464f5092/forks\",\"commits_url\":\"https://api.github.com/gists/8a658f7f63b13768d1e75fa2464f5092/commits\",\"id\":\"8a658f7f63b13768d1e75fa2464f5092\",\"node_id\":\"MDQ6R2lzdDhhNjU4ZjdmNjNiMTM3NjhkMWU3NWZhMjQ2NGY1MDky\",\"git_pull_url\":\"https://gist.github.com/8a658f7f63b13768d1e75fa2464f5092.git\",\"git_push_url\":\"https://gist.github.com/8a658f7f63b13768d1e75fa2464f5092.git\",\"html_url\":\"https://gist.github.com/8a658f7f63b13768d1e75fa2464f5092\",\"files\":{\"readme.md\":{\"filename\":\"readme.md\",\"type\":\"text/markdown\",\"language\":\"Markdown\",\"raw_url\":\"https://gist.githubusercontent.com/mariusvniekerk/8a658f7f63b13768d1e75fa2464f5092/raw/2e8a619fb4f4e229bf4ed5a83172f04e33212ced/readme.md\",\"size\":46,\"truncated\":false,\"content\":\"This is a test gist for public binderhub gists\"},\"requirements.txt\":{\"filename\":\"requirements.txt\",\"type\":\"text/plain\",\"language\":\"Text\",\"raw_url\":\"https://gist.githubusercontent.com/mariusvniekerk/8a658f7f63b13768d1e75fa2464f5092/raw/bb56d9fcd8e0f0690171d1e8b5d5df7f37da3508/requirements.txt\",\"size\":24,\"truncated\":false,\"content\":\"dask\\ndistributed\\nstreamz\"}},\"public\":true,\"created_at\":\"2017-11-29T15:05:48Z\",\"updated_at\":\"2018-03-05T21:52:24Z\",\"description\":\"binderhub-test-public\",\"comments\":0,\"user\":null,\"comments_url\":\"https://api.github.com/gists/8a658f7f63b13768d1e75fa2464f5092/comments\",\"owner\":{\"login\":\"mariusvniekerk\",\"id\":73973,\"node_id\":\"MDQ6VXNlcjczOTcz\",\"avatar_url\":\"https://avatars3.githubusercontent.com/u/73973?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/mariusvniekerk\",\"html_url\":\"https://github.com/mariusvniekerk\",\"followers_url\":\"https://api.github.com/users/mariusvniekerk/followers\",\"following_url\":\"https://api.github.com/users/mariusvniekerk/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/mariusvniekerk/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/mariusvniekerk/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/mariusvniekerk/subscriptions\",\"organizations_url\":\"https://api.github.com/users/mariusvniekerk/orgs\",\"repos_url\":\"https://api.github.com/users/mariusvniekerk/repos\",\"events_url\":\"https://api.github.com/users/mariusvniekerk/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/mariusvniekerk/received_events\",\"type\":\"User\",\"site_admin\":false},\"forks\":[],\"history\":[{\"user\":{\"login\":\"mariusvniekerk\",\"id\":73973,\"node_id\":\"MDQ6VXNlcjczOTcz\",\"avatar_url\":\"https://avatars3.githubusercontent.com/u/73973?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/mariusvniekerk\",\"html_url\":\"https://github.com/mariusvniekerk\",\"followers_url\":\"https://api.github.com/users/mariusvniekerk/followers\",\"following_url\":\"https://api.github.com/users/mariusvniekerk/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/mariusvniekerk/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/mariusvniekerk/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/mariusvniekerk/subscriptions\",\"organizations_url\":\"https://api.github.com/users/mariusvniekerk/orgs\",\"repos_url\":\"https://api.github.com/users/mariusvniekerk/repos\",\"events_url\":\"https://api.github.com/users/mariusvniekerk/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/mariusvniekerk/received_events\",\"type\":\"User\",\"site_admin\":false},\"version\":\"7daa381aae8409bfe28193e2ed8f767c26371237\",\"committed_at\":\"2017-11-29T15:05:48Z\",\"change_status\":{\"total\":4,\"additions\":4,\"deletions\":0},\"url\":\"https://api.github.com/gists/8a658f7f63b13768d1e75fa2464f5092/7daa381aae8409bfe28193e2ed8f767c26371237\"}],\"truncated\":false}",
+    "code": 200,
+    "headers": {
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Expose-Headers": "ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, Deprecation, Sunset",
+      "Cache-Control": "private, max-age=60, s-maxage=60",
+      "Content-Encoding": "gzip",
+      "Content-Security-Policy": "default-src 'none'",
+      "Content-Type": "application/json; charset=utf-8",
+      "Date": "Fri, 30 Oct 2020 08:44:15 GMT",
+      "Etag": "W/\"e05742515eeb6b088e6562df0414ba6e42fa0866878b40c99a1340e1fd68691c\"",
+      "Last-Modified": "Mon, 26 Oct 2020 14:26:23 GMT",
+      "Referrer-Policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
+      "Server": "GitHub.com",
+      "Status": "200 OK",
+      "Strict-Transport-Security": "max-age=31536000; includeSubdomains; preload",
+      "Transfer-Encoding": "chunked",
+      "Vary": "Accept, Authorization, Cookie, X-GitHub-OTP,Accept-Encoding, Accept, X-Requested-With,Accept-Encoding",
+      "X-Accepted-Oauth-Scopes": "",
+      "X-Content-Type-Options": "nosniff",
+      "X-Frame-Options": "deny",
+      "X-Github-Media-Type": "github.v3; format=json",
+      "X-Github-Request-Id": "E867:B8C1:1D31738:20C49EB:5F9BD25F",
+      "X-Http-Reason": "OK",
+      "X-Oauth-Scopes": "public_repo",
+      "X-Ratelimit-Limit": "5000",
+      "X-Ratelimit-Remaining": "4926",
+      "X-Ratelimit-Reset": "1604049898",
+      "X-Ratelimit-Used": "74",
+      "X-Xss-Protection": "1; mode=block"
+    }
+  },
+  "https://api.github.com/gists/bd01411ea4bf4eb8135893ef237398ba": {
+    "body": "{\"url\":\"https://api.github.com/gists/bd01411ea4bf4eb8135893ef237398ba\",\"forks_url\":\"https://api.github.com/gists/bd01411ea4bf4eb8135893ef237398ba/forks\",\"commits_url\":\"https://api.github.com/gists/bd01411ea4bf4eb8135893ef237398ba/commits\",\"id\":\"bd01411ea4bf4eb8135893ef237398ba\",\"node_id\":\"MDQ6R2lzdGJkMDE0MTFlYTRiZjRlYjgxMzU4OTNlZjIzNzM5OGJh\",\"git_pull_url\":\"https://gist.github.com/bd01411ea4bf4eb8135893ef237398ba.git\",\"git_push_url\":\"https://gist.github.com/bd01411ea4bf4eb8135893ef237398ba.git\",\"html_url\":\"https://gist.github.com/bd01411ea4bf4eb8135893ef237398ba\",\"files\":{\"readme.md\":{\"filename\":\"readme.md\",\"type\":\"text/markdown\",\"language\":\"Markdown\",\"raw_url\":\"https://gist.githubusercontent.com/mariusvniekerk/bd01411ea4bf4eb8135893ef237398ba/raw/5b77e9d6a35539ec178c3e25aadff070fe6e1c75/readme.md\",\"size\":60,\"truncated\":false,\"content\":\"This is a test file for binderhub wrt resolving secret gists\"},\"requirements.txt\":{\"filename\":\"requirements.txt\",\"type\":\"text/plain\",\"language\":\"Text\",\"raw_url\":\"https://gist.githubusercontent.com/mariusvniekerk/bd01411ea4bf4eb8135893ef237398ba/raw/bb56d9fcd8e0f0690171d1e8b5d5df7f37da3508/requirements.txt\",\"size\":24,\"truncated\":false,\"content\":\"dask\\ndistributed\\nstreamz\"}},\"public\":false,\"created_at\":\"2017-11-29T14:56:07Z\",\"updated_at\":\"2018-03-05T21:52:30Z\",\"description\":\"binderhub-test-secret\",\"comments\":0,\"user\":null,\"comments_url\":\"https://api.github.com/gists/bd01411ea4bf4eb8135893ef237398ba/comments\",\"owner\":{\"login\":\"mariusvniekerk\",\"id\":73973,\"node_id\":\"MDQ6VXNlcjczOTcz\",\"avatar_url\":\"https://avatars3.githubusercontent.com/u/73973?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/mariusvniekerk\",\"html_url\":\"https://github.com/mariusvniekerk\",\"followers_url\":\"https://api.github.com/users/mariusvniekerk/followers\",\"following_url\":\"https://api.github.com/users/mariusvniekerk/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/mariusvniekerk/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/mariusvniekerk/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/mariusvniekerk/subscriptions\",\"organizations_url\":\"https://api.github.com/users/mariusvniekerk/orgs\",\"repos_url\":\"https://api.github.com/users/mariusvniekerk/repos\",\"events_url\":\"https://api.github.com/users/mariusvniekerk/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/mariusvniekerk/received_events\",\"type\":\"User\",\"site_admin\":false},\"forks\":[],\"history\":[{\"user\":{\"login\":\"mariusvniekerk\",\"id\":73973,\"node_id\":\"MDQ6VXNlcjczOTcz\",\"avatar_url\":\"https://avatars3.githubusercontent.com/u/73973?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/mariusvniekerk\",\"html_url\":\"https://github.com/mariusvniekerk\",\"followers_url\":\"https://api.github.com/users/mariusvniekerk/followers\",\"following_url\":\"https://api.github.com/users/mariusvniekerk/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/mariusvniekerk/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/mariusvniekerk/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/mariusvniekerk/subscriptions\",\"organizations_url\":\"https://api.github.com/users/mariusvniekerk/orgs\",\"repos_url\":\"https://api.github.com/users/mariusvniekerk/repos\",\"events_url\":\"https://api.github.com/users/mariusvniekerk/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/mariusvniekerk/received_events\",\"type\":\"User\",\"site_admin\":false},\"version\":\"56b1968a071db4b234121510054ab3f903c83350\",\"committed_at\":\"2017-11-29T15:04:28Z\",\"change_status\":{\"total\":1,\"additions\":1,\"deletions\":0},\"url\":\"https://api.github.com/gists/bd01411ea4bf4eb8135893ef237398ba/56b1968a071db4b234121510054ab3f903c83350\"},{\"user\":{\"login\":\"mariusvniekerk\",\"id\":73973,\"node_id\":\"MDQ6VXNlcjczOTcz\",\"avatar_url\":\"https://avatars3.githubusercontent.com/u/73973?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/mariusvniekerk\",\"html_url\":\"https://github.com/mariusvniekerk\",\"followers_url\":\"https://api.github.com/users/mariusvniekerk/followers\",\"following_url\":\"https://api.github.com/users/mariusvniekerk/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/mariusvniekerk/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/mariusvniekerk/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/mariusvniekerk/subscriptions\",\"organizations_url\":\"https://api.github.com/users/mariusvniekerk/orgs\",\"repos_url\":\"https://api.github.com/users/mariusvniekerk/repos\",\"events_url\":\"https://api.github.com/users/mariusvniekerk/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/mariusvniekerk/received_events\",\"type\":\"User\",\"site_admin\":false},\"version\":\"72997b34f5b0d6949e9e3750889e0b3ff7b5c066\",\"committed_at\":\"2017-11-29T14:56:07Z\",\"change_status\":{\"total\":3,\"additions\":3,\"deletions\":0},\"url\":\"https://api.github.com/gists/bd01411ea4bf4eb8135893ef237398ba/72997b34f5b0d6949e9e3750889e0b3ff7b5c066\"}],\"truncated\":false}",
+    "code": 200,
+    "headers": {
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Expose-Headers": "ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, Deprecation, Sunset",
+      "Cache-Control": "private, max-age=60, s-maxage=60",
+      "Content-Encoding": "gzip",
+      "Content-Security-Policy": "default-src 'none'",
+      "Content-Type": "application/json; charset=utf-8",
+      "Date": "Fri, 30 Oct 2020 08:44:16 GMT",
+      "Etag": "W/\"40ccec8838b89201e96ad422ce75800f57cf148b9113bdca6f35cf782f48664c\"",
+      "Last-Modified": "Mon, 26 Oct 2020 14:26:23 GMT",
+      "Referrer-Policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
+      "Server": "GitHub.com",
+      "Status": "200 OK",
+      "Strict-Transport-Security": "max-age=31536000; includeSubdomains; preload",
+      "Transfer-Encoding": "chunked",
+      "Vary": "Accept, Authorization, Cookie, X-GitHub-OTP,Accept-Encoding, Accept, X-Requested-With,Accept-Encoding",
+      "X-Accepted-Oauth-Scopes": "",
+      "X-Content-Type-Options": "nosniff",
+      "X-Frame-Options": "deny",
+      "X-Github-Media-Type": "github.v3; format=json",
+      "X-Github-Request-Id": "E869:37E8:689829:750AF2:5F9BD25F",
+      "X-Http-Reason": "OK",
+      "X-Oauth-Scopes": "public_repo",
+      "X-Ratelimit-Limit": "5000",
+      "X-Ratelimit-Remaining": "4924",
+      "X-Ratelimit-Reset": "1604049898",
+      "X-Ratelimit-Used": "76",
+      "X-Xss-Protection": "1; mode=block"
+    }
+  }
+}