feat: support tokens scoped to multiple repositories within organization #46

timreimherr · 2023-09-20T21:33:01Z

This adds support for a token to be scoped to multiple repositories within an organization.

resolves #4

gr2m

Thank you for the pull request!

I think there are two use cases we should support which are not covered by your code changes

Create token for a given organization for all repositories
Create token for current organization but for all repositories

For 1. if owner is set and repositories is not, then the token should have access across all repositories
For 2. we could recommend to set owner to env.GITHUB_REPOSITORY_OWNER (See environment variables)

With these use cases things will get a bit complicated and I think we should add tests for them. I can help with the tests if needed

timreimherr · 2023-09-21T17:40:17Z

@gr2m thanks for the feedback! Just pushed the changes you requested. Started to work on tests but my lack of time kept me from tests. So, I'll definitely take your offer to help with the tests! 🙇 👍

gr2m

did you try if it works as expected? You can update the build file and then use uses: timreimherr/create-github-app-token. I think if you don't set owner and repositories, then it will now create a token that has access to all repositories of the current repository owner's installation, instead of defaulting to just the current repository only

README.md

action.yml

collinmcneese · 2023-09-26T18:46:55Z

This is wonderful and extends the functionality of this action by quite a bit! 🎉

gr2m

I also updated the dist/main.cjs file

gr2m · 2023-09-29T04:31:45Z

lib/main.js

@@ -32,23 +46,31 @@ export async function main(
  // Get the installation ID
  // https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#get-a-repository-installation-for-the-authenticated-app
  const { data: installation } = await request(
-    "GET /repos/{owner}/{repo}/installation",
+    "GET /orgs/{org}/installation",


if we need to get the installation ID for the current owner, we should keep doing it using GET /repos/{owner}/{repo}/installation. Because if the owner is set to something else, we need to check two endpoints, because the owner can be either an org or a user:

GET /orgs/{org}/installation

GET /users/{username}/installation

See my suggested change at timreimherr#1

tjorvi · 2023-09-29T20:10:41Z

dist/main.cjs

    {
-      owner,
-      repo,
+      org,


org is always empty here if owner2 is passed to this function

The dist/* files are compiled build files. Better comment on the main.js and lib/main.js

I think that my PR here addresses your concern timreimherr#1

This was an issue I ran into when trying to use your fork as an action. It might be that the dist file wasn't up to date at the time I made the comment, I just assumed it would be.

ah makes sense, thank you for clarifying

README.md

action.yml

gr2m

still lacking tests but we can merge it as is now, I tested it manually. Waiting for review by @parkerbxyz to make sure I didn't miss anything

What I would love us to do as soon as this is merged is to create end-to-end tests to cover the different use cases for the new owner and repositories arguments, based off our existing end-to-end test:

create-github-app-token/.github/workflows/test.yml

Lines 25 to 49 in 5804f04

    
           end-to-end: 
        
             name: End-to-End 
        
             runs-on: ubuntu-latest 
        
             # do not run from forks, as forks don’t have access to repository secrets 
        
             if: github.event.pull_request.head.repo.owner.login == github.event.pull_request.base.repo.owner.login 
        
             steps: 
        
               - uses: actions/checkout@v4 
        
               - uses: actions/setup-node@v3 
        
                 with: 
        
                   node-version: 20 
        
                   cache: "npm" 
        
               - run: npm ci 
        
               - run: npm run build 
        
               - uses: ./ # Uses the action in the root directory 
        
                 id: test 
        
                 with: 
        
                   app_id: ${{ vars.TEST_APP_ID }} 
        
                   private_key: ${{ secrets.TEST_APP_PRIVATE_KEY }} 
        
               - uses: octokit/request-action@v2.x 
        
                 id: get-repository 
        
                 env: 
        
                   GITHUB_TOKEN: ${{ steps.test.outputs.token }} 
        
                 with: 
        
                   route: GET /installation/repositories 
        
               - run: echo '${{ steps.get-repository.outputs.data }}'

lib/main.js

Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>

# [1.3.0](v1.2.2...v1.3.0) (2023-10-04) ### Features * support tokens scoped to multiple repositories within organization ([#46](#46)) ([20fd863](20fd863))

create-app-token-action-releaser · 2023-10-04T05:29:24Z

🎉 This PR is included in version 1.3.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

timreimherr added 2 commits September 20, 2023 21:19

support token scope to multiple repos

12bf248

update documentation

9c2fe6b

timreimherr requested review from gr2m, parkerbxyz and a team as code owners September 20, 2023 21:33

gr2m suggested changes Sep 21, 2023

View reviewed changes

timreimherr added 4 commits September 21, 2023 14:55

if owner not set default to current repo owner

4e0d015

default to all repos if none are supplied

151c72e

tests for lib/main.js

84c746a

remove jest test

98d3657

timreimherr requested a review from gr2m September 21, 2023 17:28

Update documentation

63a98a7

gr2m added 2 commits September 21, 2023 14:09

Merge branch 'main' into main

8f5a382

Merge branch 'main' into main

a12bbe4

gr2m reviewed Sep 22, 2023

View reviewed changes

timreimherr added 3 commits September 22, 2023 14:50

allow for 'owner' to be empty

fb1cbf7

scope according to input

c21d2ca

Update documentation

6d39deb

gr2m reviewed Sep 22, 2023

View reviewed changes

README.md Outdated Show resolved Hide resolved

README.md Outdated Show resolved Hide resolved

README.md Outdated Show resolved Hide resolved

README.md Outdated Show resolved Hide resolved

README.md Outdated Show resolved Hide resolved

timreimherr added 2 commits September 22, 2023 16:04

clarify documentation

90239ca

change action name for publishing

3cfbd0e

qoomon reviewed Sep 23, 2023

View reviewed changes

action.yml Outdated Show resolved Hide resolved

fix action name

e8a138f

parkerbxyz linked an issue Sep 27, 2023 that may be closed by this pull request

Support tokens with access to custom repositories and user/organization accounts #4

Closed

build: dist/main.cjs

7c7676d

gr2m reviewed Sep 29, 2023

View reviewed changes

gr2m mentioned this pull request Sep 29, 2023

Create token for multiple organization/user accounts #45

Closed

tjorvi reviewed Sep 29, 2023

View reviewed changes

parkerbxyz and others added 3 commits October 2, 2023 17:53

Merge branch 'main' into main

4b133dc

update main

68894b6

build update for testing

02c936f

gr2m reviewed Oct 3, 2023

View reviewed changes

README.md Outdated Show resolved Hide resolved

Update README.md

73f98bd

gr2m reviewed Oct 3, 2023

View reviewed changes

action.yml Outdated Show resolved Hide resolved

gr2m added 3 commits October 3, 2023 10:38

Update action.yml

91b880c

build(package): lock file

80484a9

build files for testing (after updating dependencies)

aa7595e

gr2m approved these changes Oct 3, 2023

View reviewed changes

parkerbxyz added 5 commits October 3, 2023 15:27

Use sentence case in comments for consistency

2df34b8

Remove language codes from GitHub Docs URLs

13b24f0

Move note to a dedicated section

9dcf16e

Reword step 1

dad2c36

Update example usage headers

0a057cb

parkerbxyz reviewed Oct 3, 2023

View reviewed changes

lib/main.js Outdated Show resolved Hide resolved

Update lib/main.js

7c0311c

Co-authored-by: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>

parkerbxyz approved these changes Oct 4, 2023

View reviewed changes

gr2m merged commit 20fd863 into actions:main Oct 4, 2023
2 checks passed

create-app-token-action-releaser bot added the released label Oct 4, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: support tokens scoped to multiple repositories within organization #46

feat: support tokens scoped to multiple repositories within organization #46

timreimherr commented Sep 20, 2023 •

edited by gr2m

Loading

gr2m left a comment •

edited

Loading

timreimherr commented Sep 21, 2023

gr2m left a comment

collinmcneese commented Sep 26, 2023

gr2m left a comment

gr2m Sep 29, 2023

gr2m Sep 29, 2023

tjorvi Sep 29, 2023

gr2m Oct 2, 2023

tjorvi Oct 2, 2023

gr2m Oct 2, 2023

gr2m left a comment •

edited

Loading

create-app-token-action-releaser bot commented Oct 4, 2023

	end-to-end:
	name: End-to-End
	runs-on: ubuntu-latest
	# do not run from forks, as forks don’t have access to repository secrets
	if: github.event.pull_request.head.repo.owner.login == github.event.pull_request.base.repo.owner.login
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v3
	with:
	node-version: 20
	cache: "npm"
	- run: npm ci
	- run: npm run build
	- uses: ./ # Uses the action in the root directory
	id: test
	with:
	app_id: ${{ vars.TEST_APP_ID }}
	private_key: ${{ secrets.TEST_APP_PRIVATE_KEY }}
	- uses: octokit/request-action@v2.x
	id: get-repository
	env:
	GITHUB_TOKEN: ${{ steps.test.outputs.token }}
	with:
	route: GET /installation/repositories
	- run: echo '${{ steps.get-repository.outputs.data }}'

feat: support tokens scoped to multiple repositories within organization #46

feat: support tokens scoped to multiple repositories within organization #46

Conversation

timreimherr commented Sep 20, 2023 • edited by gr2m Loading

gr2m left a comment • edited Loading

Choose a reason for hiding this comment

timreimherr commented Sep 21, 2023

gr2m left a comment

Choose a reason for hiding this comment

collinmcneese commented Sep 26, 2023

gr2m left a comment

Choose a reason for hiding this comment

gr2m Sep 29, 2023

Choose a reason for hiding this comment

gr2m Sep 29, 2023

Choose a reason for hiding this comment

tjorvi Sep 29, 2023

Choose a reason for hiding this comment

gr2m Oct 2, 2023

Choose a reason for hiding this comment

tjorvi Oct 2, 2023

Choose a reason for hiding this comment

gr2m Oct 2, 2023

Choose a reason for hiding this comment

gr2m left a comment • edited Loading

Choose a reason for hiding this comment

create-app-token-action-releaser bot commented Oct 4, 2023

timreimherr commented Sep 20, 2023 •

edited by gr2m

Loading

gr2m left a comment •

edited

Loading

gr2m left a comment •

edited

Loading