Conversation
| required gh token scopes: | ||
| - repo: push commits TBC | ||
| - admin:org: create repos TBC | ||
| - workflow: push commits containing `.github/workflows/*.yml` files | ||
| - delete_repo: delete `lewagon-test` and `lewagon-qa` repositories | ||
| """ |
There was a problem hiding this comment.
❔ To make sure I understood correctly, so the GH_API_DELETE_TOKEN should have all these rights?
There was a problem hiding this comment.
@The-Pavel the scopes of the tokens we agreed on for the moment are described in this doc
in the myriad test gha you can see that GH_API_DELETE_TOKEN is a specific env var used by the myriad code in order to retrieve the AUTOBOT_QA_ADMIN_TOKEN secret containing a token which corresponds to this quite powerful scope (but only works on the QA org)
There was a problem hiding this comment.
so at the moment the tokens described by the doc are only used in GHA through a mapping to env vars used by the command lines or script code of the GHA
There was a problem hiding this comment.
the tokens exist in the lewagon-test and lewagon-qa orgs, so you can map them to your GHA when you need to test something, and their scope should correspond to the one of the secret with the same name in the lewagon org
there might remain some diffs in the token scopes and token user membership in the lewagon org, but we are trying to figure them out, and the ghadmin tool will help get rid of the differences
The-Pavel
left a comment
There was a problem hiding this comment.
LGTM @gmanchon ! 🙌
Works as expected locally.
P.S. you are right, I also can't find an API to list secrets in PyGithub, but it has methods for creating and updating secrets, and it's just a wrapper around GH API, maybe in the future we can even contribute our own method to read secrets if we choose to use it 🙌
As for GhRepo class, I think for that we can consider PyGithub in the future.
|
it would be so cool to use it and contribute 🔥 |
GitRepo,GhOrg,GhOrgSecretandGhRepohelper classesGhRepoclasssubblack,subred,subgreen,subyellow,subblue,submagenta,subcyan, andsubwhitehelpers forcoloramaGitHubRepoconstructor params (usernameremoved)requires #15
required by https://github.com/lewagon/utils/pull/82