On Wednesday, March 21, 2018 10:32:08 AM CET Miroslav Suchý wrote:
During yesterday meeting I forgot to bring up the topic of GitHub
apps.
During the preparation of
https://docs.google.com/forms/d/e/1FAIpQLSckxxUeAWKwUzjju6ftDjPeNWVWT_2_Y...
I stumbled upon
https://developer.github.com/apps/getting-started-with-building-apps/
and according the graph, it is straightforward that we likely want to use
GitHub App with OAuthApp, which is IMHO best from security POV and both from
developer and user perspective.
Comments?
IMO GitHub App is enough. Usual workflow would be to:
1. create the GitHub App
2. .. with good-enough fine-grained permissions (usually "Read and write
access to commit statuses" is enough)
3. grant that app access only to particular repository(ies)
4. store **only** the **app** credentials into copr
In such case, there's almost nothing to worry about basically. So there
shouldn't be reason to not have the feature from security POV.
OTOH, to make this somewhat useful, we have to have much better support
for GitHub Pull requests. But yes, this is basically absolutely necessary
feature if we want to
- securely submit copr build for PR in github (via webhook) and
- let the "CI bits" in github PR updated automatically by Copr
Pavel