Description
ADO made a change in behavior around June 2nd that required the GitHub PAT used to configure Board integration to have the minimal subset of permissions/scopes. If the PAT has ANY extra permissions ADO will error when trying to configure Boards integration.
Note: This is what is causing all the ADO integration tests to fail currently.
This causes a problem if customers use ado2gh
the way we intend where they first run ado2gh generate-script
then run the script to perform the migration. Because the script assumes that you are going to use the same GitHub PAT to both perform the migration and configure Boards integration, which will fail on the Boards integration step.
I can see at least 3 paths forward:
- Change it so that customers have to provide 2 different GH PATs with different permissions, one that is used to migrate the repos, and another that is used to setup the boards integration
- Change the CLI to use a GitHub App instead of a PAT to setup the boards connection. This is the better way to do it anyways, and we've had an issue on our backlog to switch to this better design for years now
- Get rid of
integrate-boards
command, or at least remove it from the script generated as a result ofgenerate-script
My suggestion would be number 2, and rework our code to use a GitHub App instead of a PAT when configuring the ADO Boards integration in ado2gh integrate-boards
command.
Reproduction Steps
This is what it looks like in the logs when it fails:
If you try to manually configure the Board integration in the ADO UI this is the error you will receive: