github-community-projects / github-community-projects/safe-settings

Environment reviewers must have at least one reviewer to set prevent_self_review

Open
#628 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
921
Forks
226
Avg merge
18h 3m
Merged PRs (30d)
14

Description

## Problem Description
 
When creating environments that have reviewers set and the `prevent_self_review` setting to `true`, safe-settings does not process all environments correctly when first creating the environments and complains that the reviewer's section is not set even though it is configured correctly. On the second pass, it will create the rest of the `prod` environment which failed to provision correctly.
 
### What is actually happening
 
Safe settings will create the three environments with no reviewers and then error out on the `prod` environment leaving it partially provisioned. The pod running safe-settings will restart and when restarted it will finish provisioning the prod environment correctly.
 
### What is the expected behavior
 
Safe settings should create all the environments when triggered to do so without any errors or pod restarts.
 
### Error output, if available
 
```
Error HttpError: Failed to create or update the environment protection rule. Required reviewers must have at least one reviewer to set prevent_self_review. in Environments for repo: {"owner":"XXX","repo":"XXXXXXX","branch":"master"} entries [{"name":"dev","wait_timer":0,"prevent_self_review":false,"reviewers":[],"deployment_branch_policy":{"protected_branches":false,"custom_branch_policies":[]},"variables":[{"name":"base_environment","value":"DEV"}],"deployment_protection_rules":[]},{"name":"qat","wait_timer":0,"prevent_self_review":false,"reviewers":[],"deployment_branch_policy":{"protected_branches":false,"custom_branch_policies":[]},"variables":[{"name":"base_environment","value":"QAT"}],"deployment_protection_rules":[]},{"name":"uat","wait_timer":0,"prevent_self_review":false,"reviewers":[],"deployment_branch_policy":{"protected_branches":false,"custom_branch_policies":[]},"variables":[{"name":"base_environment","value":"UAT"}],"deployment_protection_rules":[]},{"name":"prod","wait_timer":0,"prevent_self_review":true,"reviewers":[{"type":"Team","id":17632}],"deployment_branch_policy":{"protected_branches":true,"custom_branch_policies":false},"variables":[{"name":"base_environment","value":"PROD"}],"deployment_protection_rules":[]}]
```
 
## Context
 
When we first started configuring environments we noticed there were a lot of errors related to attributes like `variables`, `deployment_protection_rules` and `custom_branch_policies` not being iterable or simply not having these attributes declared in the configuration causing various errors. So the final configuration we landed on was the one below which declares all the settings and if we do not want to apply those settings we leave the value with `[]`.

This configuration works well except now we get unexpected behaviour where upon creating the environments safe-settings complains that `Required reviewers must have at least one reviewer to set prevent_self_review.` This would be for the `prod` environment.

### Environments suborg configuration

```yaml
environments:
- name: dev
wait_timer: 0
prevent_self_review: false
reviewers: []
deployment_branch_policy:
protected_branches: false
custom_branch_policies: []
variables:
- name: BASE_ENVIRONMENT
value: DEV
deployment_protection_rules: []
- name: qat
wait_timer: 0
prevent_self_review: false
reviewers: []
deployment_branch_policy:
protected_branches: false
custom_branch_policies: []
variables:
- name: BASE_ENVIRONMENT
value: QAT
deployment_protection_rules: []
- name: uat
wait_timer: 0
prevent_self_review: false
reviewers: []
deployment_branch_policy:
protected_branches: false
custom_branch_policies: []
variables:
- name: BASE_ENVIRONMENT
value: UAT
deployment_protection_rules: []
- name: prod
wait_timer: 0
prevent_self_review: true
reviewers:
- type: Team
id: 17632
deployment_branch_policy:
protected_branches: true
custom_branch_policies: false
variables:
- name: BASE_ENVIRONMENT
value: PROD
deployment_protection_rules: []
```
 
### Are you using the hosted instance of probot/settings or running your own?
 
Running safe settings on AKS with ingress for webhook.
 
### If running your own instance, are you using it with github.com or GitHub Enterprise?
 
GitHub Enterprise Server
 
#### Version of probot/settings
 
Running Probot v12.3.3 (Node.js: v16.20.2)
 
#### Version of GitHub Enterprise
 
GitHub Enterprise Server 3.12.2

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.