Support for ppc64le runner using GitHub in spring-boot

[ashwinik307]

There is now support added for ppc64le runner using a GitHub app, following is the onboarding process for same, we would like to have it in spring-boot to have power images/binaries being built and published. Also we can help out with the process and also setup a call if needed.

https://github.com/IBM/actionspz/blob/main/docs/onboarding.md

Following are some of the repos of the many which have started/will be using the same
numpy/numpy#29125
pyca/cryptography#13086
scipy/scipy#23379

Looking after this as it's been a long time for the P support added.

[ashwinik307]

any comments/ suggestions appreciated

[philwebb]

Looking at https://github.com/IBM/actionspz/blob/main/docs/FAQ.md#what-permissions-are-granted-to-the-github-app I do not think we'd be able to add support. We have quite strict security requirements about apps we can install to GitHub. We also don't publish any binaries or images for Spring Boot, only Java JAR files which are platform agnostic.

Thanks anyway for the suggestion.

[ashwinik307]

hi @philwebb , Could you please explain more on which arch spring-boot GHA is enabled currently . Also Is GHA set up for x86_64 ? If so, why is the implementation method for Power different such that security concerns are raised?

[philwebb]

Could you please explain more on which arch spring-boot GHA is enabled currently

We currently build for x86 on CI for Windows and Linux. We build on multiple operating systems because Java treats paths differently and we want to catch errors. We don't build for other architectures because we assume that the Java Virtual Machine will abstract differences away.

Why is the implementation method for Power different such that security concerns are raised

The concern isn't with Power architecture itself, but rather using a GitHub runner that we don't control and needing to provide "read and write access to actions".

[ashwinik307]

thanks @philwebb for your clarification

[mtarsel]

Hi @philwebb I'm the engineering lead for GitHub Actions on ppc64le (and of course I work very close with the Z team!)... here is more info about our permissions: https://github.com/IBM/actionspz/blob/main/docs/FAQ.md#what-permissions-are-granted-to-the-github-app

Given the way the GitHub API works, its not out of the ordinary for GitHub Apps to require these tokens for CI/CD (examples like BuildJet and CircleCI). We actually require less permissions than these other apps and our service is completely free of charge. Additionally, we have tested the permissions for our GitHub app and it is the minimum permissions required.

We have already onboarded ~250 repos across different organizations so please let me know if I can clear up any security concerns. Security and ease of use are the top priorities for GitHub Actions on Power (ppc64le) and Z (s390x). We try to make this onboarding process as simple as possible for more thorough testing on P and Z hardware :)

[philwebb]

We actually require less permissions than these other apps and our service is completely free of charge

Understood. Unfortunately this is more a corporate policy restriction for us than anything else. Getting approval for any third-party runner is pretty difficult.