Create new role for sigstore-bot in root-signing-staging #395

jku · 2024-02-01T11:35:57Z

Role allows bypassing branch protections
This replaces the use of a separate review bot
Plan is to test this out in root-signing-staging, and later apply same structure to root-signing

See sigstore/github-sync#117 for more context. This is a draft until sigstore/github-sync#118 is merged.

* Role allows bypassing branch protections * This replaces the use of a separate review bot * Plan is to test this out in root-signing-staging, and later apply same structure to root-signing Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

jku · 2024-02-02T07:51:41Z

github-sync 118 is merged, thanks cpanato. The newest run (using github-sync adec712) still fails the same way:
Failed to load config: failed to parse github-data/sigstore/roles.yaml: failed to parse yaml: error unmarshaling JSON: while decoding JSON: json: unknown field "repositoryRoles"

So there has to be some problem in the code or this PR still. I will look into it.

cpanato · 2024-02-02T07:53:50Z

yes, i will try to look on that as well

jku · 2024-02-02T08:09:17Z

The parser is expecting the top level field to be "customRoles": I thought it would be "repositoryRoles" based on Config.go:

type Config struct {
	Users        []User       `yaml:"users"`
	Teams        []Team       `yaml:"teams"`
	Repositories []Repository `yaml:"repositories"`
	CustomRoles  []CustomRole `yaml:"repositoryRoles"`
}

Don't ask why I used two different names -- that was not really intentional just a result of GitHub docs using two names. I still thought the current setup would work...

jku · 2024-02-02T08:17:00Z

Oh I am missing something in the parser code as well: func (p *Parser) Parse has custom code for the toplevel fields... Looks like I'll have to do some changes in github-sync still

github-actions · 2024-02-02T08:37:17Z

🍹 `preview` on sigstore-github-sync/sigstore/github-prod

Pulumi report

Previewing update (sigstore/github-prod)

View Live: https://app.pulumi.com/sigstore/sigstore-github-sync/github-prod/previews/a33ba646-2179-4503-b850-dbf7b11f2770

@ Previewing update.....
pulumi:pulumi:Stack: (same)
[urn=urn:pulumi:github-prod::sigstore-github-sync::pulumi:pulumi:Stack::sigstore-github-sync-github-prod]
+ github:index/organizationCustomRole:OrganizationCustomRole: (create)
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/organizationCustomRole:OrganizationCustomRole::write-with-bypass]
    baseRole   : "write"
    description: "write role with an additional permission to bypass branch protection"
    name       : "write-with-bypass-d37e593"
    permissions: [
        [0]: "bypass_branch_protection"
    ]
@ Previewing update....
+-github:index/repositoryCollaborator:RepositoryCollaborator: (replace)
    [id=root-signing-staging:sigstore-bot]
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/repositoryCollaborator:RepositoryCollaborator::root-signing-staging-sigstore-bot]
  ~ permission: "push" => "write-with-bypass"
- github:index/repositoryCollaborator:RepositoryCollaborator: (delete)
    [id=root-signing-staging:sigstore-review-bot]
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/repositoryCollaborator:RepositoryCollaborator::root-signing-staging-sigstore-review-bot]
    permission               : "push"
    permissionDiffSuppression: false
    repository               : "root-signing-staging"
    username                 : "sigstore-review-bot"
Resources:
+ 1 to create
- 1 to delete
+-1 to replace
3 changes. 573 unchanged

jku · 2024-02-02T08:40:08Z

The PR in github-sync is needed before the preview should show anything as my yaml config change is currently not actually appended to pulumi config:
sigstore/github-sync#119

The name is now consistently customRoles everywhere. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

In pulumi args permission "push" usually seems to mean Github role "write"... but that does not work for custom roles base role. Use 'write' as the base role. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

jku · 2024-02-02T11:30:43Z

Well the change seems to have happened:

     +-github:index/repositoryCollaborator:RepositoryCollaborator: (replace)
         [id=root-signing-staging:sigstore-bot]
         [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/repositoryCollaborator:RepositoryCollaborator::root-signing-staging-sigstore-bot]
       ~ permission: "push" => "write-with-bypass"

I'm happy to try this out and see what happens in root-signing-staging... Marking this ready for review. CC @haydentherapper

There's a lot of churn in the log that seems unrelated but that I don't understand:

Resources:
+ 2 to create
~ 48 to update
- 1 to delete
+-1 to replace
52 changes. 524 unchanged

is that expected?

haydentherapper · 2024-02-02T16:41:07Z

All the changes are because there’s a bug right now, where the last few changes haven’t been synced (see the failure on the last commit at HEAD)

jku · 2024-02-07T08:46:14Z

pulumi preview now looks like expected after #397

cpanato · 2024-02-07T10:57:08Z

re-run the job and now looks better :)

haydentherapper · 2024-02-07T19:10:25Z

Can someone approve and merge now?

bobcallaway · 2024-02-07T19:32:00Z

202
    pulumi:pulumi:Stack: (same)
203
      [urn=urn:pulumi:github-prod::sigstore-github-sync::pulumi:pulumi:Stack::sigstore-github-sync-github-prod]
204
      + github:index/organizationCustomRole:OrganizationCustomRole: (create)
205
          [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/organizationCustomRole:OrganizationCustomRole::write-with-bypass]
206
          baseRole   : "write"
207
          description: "write role with an additional permission to bypass branch protection"
208
          name       : "write-with-bypass-3d9b256"
209
          permissions: [
210
              [0]: "bypass_branch_protection"
211
          ]
212
          --outputs:--
213
          id         : "13311"
214
  Resources:
215
      + 1 created
216
      450 unchanged
217
  Duration: 53s
218
      at Object.createCommandError (/home/runner/work/_actions/pulumi/actions/76683de37aa44910871ba6cef36557780f2e41d1/webpack:/pulumi-github-action/node_modules/@pulumi/pulumi/automation/errors.js:77:1)
219
      at Object.<anonymous> (/home/runner/work/_actions/pulumi/actions/76683de37aa44910871ba6cef36557780f2e41d1/webpack:/pulumi-github-action/node_modules/@pulumi/pulumi/automation/cmd.js:76:1)
220
      at Generator.throw (<anonymous>)
221
      at rejected (/home/runner/work/_actions/pulumi/actions/76683de37aa44910871ba6cef36557780f2e41d1/webpack:/pulumi-github-action/node_modules/@pulumi/pulumi/automation/cmd.js:19:1)
222
      at processTicksAndRejections (node:internal/process/task_queues:95:5)

haydentherapper · 2024-02-08T06:50:16Z

@jku we might have to split this PR into two. I think the error is because the role does not yet exist, so the script fails to assign the new role even though it’s created later in the script. Wish pulumi had a way to define dependents…

jku · 2024-02-08T08:25:32Z

@jku we might have to split this PR into two. I think the error is because the role does not yet exist, so the script fails to assign the new role even though it’s created later in the script.

I can do that but

half of it did already get deployed: the custom role now exists, you can see the ghost in the completely unrelated Add Pages publishing to root-signing-staging #398...
The script does things in correct order AFAICT. Either the GH API is not immediately consistent or there is some bug in my code

So an alternative we could try (unless there's a danger I don't see) is to just re-run this deployment: the custom role now seems to exist in GitHub so if the rest of the code is correct, it should now go through)...

EDIT: still failing so there is a problem in my code...

This is a revert of half of sigstore#395. 'pulumi up' fails with this: 422 Role `write-with-bypass` is not available for the sigstore/root-signing-staging repository. I'm not sure why the custom role is not found. Let's revert this and I will investigate. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

This is a revert of half of #395. 'pulumi up' fails with this: 422 Role `write-with-bypass` is not available for the sigstore/root-signing-staging repository. I'm not sure why the custom role is not found. Let's revert this and I will investigate. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

jku mentioned this pull request Feb 2, 2024

parser: Handle custom roles sigstore/github-sync#119

Merged

jku added 2 commits February 2, 2024 10:43

roles: Use different toplevel field name

366dcf8

The name is now consistently customRoles everywhere. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

Custom role Use 'write' instead of 'push' as the base role

83c6756

In pulumi args permission "push" usually seems to mean Github role "write"... but that does not work for custom roles base role. Use 'write' as the base role. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

jku force-pushed the use-custom-role-in-root-signing-staging branch from b9df5ca to 83c6756 Compare February 2, 2024 11:19

jku marked this pull request as ready for review February 2, 2024 11:30

jku requested a review from a team as a code owner February 2, 2024 11:30

bobcallaway approved these changes Feb 7, 2024

View reviewed changes

bobcallaway merged commit 485faf7 into sigstore:main Feb 7, 2024
3 checks passed

This was referenced Feb 8, 2024

Add Pages publishing to root-signing-staging #398

Merged

Updating TUF root repo codeowners #394

Merged

jku mentioned this pull request Feb 8, 2024

root-signing-staging: Do not use the new role yet #400

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create new role for sigstore-bot in root-signing-staging #395

Create new role for sigstore-bot in root-signing-staging #395

jku commented Feb 1, 2024

jku commented Feb 2, 2024

cpanato commented Feb 2, 2024

jku commented Feb 2, 2024

jku commented Feb 2, 2024

github-actions bot commented Feb 2, 2024 •

edited

Loading

jku commented Feb 2, 2024

jku commented Feb 2, 2024 •

edited

Loading

haydentherapper commented Feb 2, 2024

jku commented Feb 7, 2024

cpanato commented Feb 7, 2024

haydentherapper commented Feb 7, 2024

bobcallaway commented Feb 7, 2024 •

edited

Loading

haydentherapper commented Feb 8, 2024

jku commented Feb 8, 2024 •

edited

Loading

Create new role for sigstore-bot in root-signing-staging #395

Create new role for sigstore-bot in root-signing-staging #395

Conversation

jku commented Feb 1, 2024

jku commented Feb 2, 2024

cpanato commented Feb 2, 2024

jku commented Feb 2, 2024

jku commented Feb 2, 2024

github-actions bot commented Feb 2, 2024 • edited Loading

🍹 preview on sigstore-github-sync/sigstore/github-prod

jku commented Feb 2, 2024

jku commented Feb 2, 2024 • edited Loading

haydentherapper commented Feb 2, 2024

jku commented Feb 7, 2024

cpanato commented Feb 7, 2024

haydentherapper commented Feb 7, 2024

bobcallaway commented Feb 7, 2024 • edited Loading

haydentherapper commented Feb 8, 2024

jku commented Feb 8, 2024 • edited Loading

github-actions bot commented Feb 2, 2024 •

edited

Loading

🍹 `preview` on sigstore-github-sync/sigstore/github-prod

jku commented Feb 2, 2024 •

edited

Loading

bobcallaway commented Feb 7, 2024 •

edited

Loading

jku commented Feb 8, 2024 •

edited

Loading