Skip to content

ado2gh integrate-boards doesn't work with the same GitHub PAT used for migrations #1357

Open
@dylan-smith

Description

@dylan-smith

ADO made a change in behavior around June 2nd that required the GitHub PAT used to configure Board integration to have the minimal subset of permissions/scopes. If the PAT has ANY extra permissions ADO will error when trying to configure Boards integration.

Note: This is what is causing all the ADO integration tests to fail currently.

This causes a problem if customers use ado2gh the way we intend where they first run ado2gh generate-script then run the script to perform the migration. Because the script assumes that you are going to use the same GitHub PAT to both perform the migration and configure Boards integration, which will fail on the Boards integration step.

I can see at least 3 paths forward:

  1. Change it so that customers have to provide 2 different GH PATs with different permissions, one that is used to migrate the repos, and another that is used to setup the boards integration
  2. Change the CLI to use a GitHub App instead of a PAT to setup the boards connection. This is the better way to do it anyways, and we've had an issue on our backlog to switch to this better design for years now
  3. Get rid of integrate-boards command, or at least remove it from the script generated as a result of generate-script

My suggestion would be number 2, and rework our code to use a GitHub App instead of a PAT when configuring the ADO Boards integration in ado2gh integrate-boards command.

Reproduction Steps

This is what it looks like in the logs when it fails:

Image

If you try to manually configure the Board integration in the ADO UI this is the error you will receive:

Image

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions