On Wednesday, March 21, 2018 10:32:08 AM CET Miroslav Suchý wrote:
During yesterday meeting I forgot to bring up the topic of GitHub apps. During the preparation of https://docs.google.com/forms/d/e/1FAIpQLSckxxUeAWKwUzjju6ftDjPeNWVWT_2_Y7md...
I stumbled upon
https://developer.github.com/apps/getting-started-with-building-apps/
and according the graph, it is straightforward that we likely want to use GitHub App with OAuthApp, which is IMHO best from security POV and both from developer and user perspective.
Comments?
IMO GitHub App is enough. Usual workflow would be to:
1. create the GitHub App 2. .. with good-enough fine-grained permissions (usually "Read and write access to commit statuses" is enough) 3. grant that app access only to particular repository(ies) 4. store **only** the **app** credentials into copr
In such case, there's almost nothing to worry about basically. So there shouldn't be reason to not have the feature from security POV.
OTOH, to make this somewhat useful, we have to have much better support for GitHub Pull requests. But yes, this is basically absolutely necessary feature if we want to - securely submit copr build for PR in github (via webhook) and - let the "CI bits" in github PR updated automatically by Copr
Pavel