tektoncd / tektoncd/pipelines-as-code
Github scoped token generation does not work at repository level
@zakisk is already working on this.
Since Mar 6, 2025.
- Dominant language
- Go
- Stars
- 214
- Forks
- 144
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 27
Description
Hi!
In contrary to what the doc says, the list of github_app_token_scope_repos specified in a Repository custom resource it's ignored if the secret-github-app-token-scoped setting is enabled.
This is for two reasons:
- There is a check that fails on purpose if the
secret-github-app-scope-extra-reposis empty, but it's not supposed to. In fact one might want to broaden the scope of the token only at repository level. - Even if the case before does not occur because there are some
secret-github-app-scope-extra-reposset, while generating the token we'll get (apart from the wrongfully formatted log warning, see the example at the end) a 404 from github because the token that it's being used in the context is scoped only for the secret-github-app-scope-extra-repos
Additionally, the fact that the failures in the generation of the token are ignored causes the confusing effect of a log that asserts later in the code that it worked for all the repos either way.
Example of output:
{"level":"info","ts":"2025-03-03T16:36:32.544Z","logger":"pipelinesascode","caller":"github/parse_payload.go:200","msg":"Github token scope extended to [myorg/repo1] keeping SecretGHAppRepoScoped to true","provider":"github","event-id":"a998700c-f84d-11ef-8b49-2d3f0e456aef"}
{"level":"info","ts":"2025-03-03T16:36:33.193Z","logger":"pipelinesascode","caller":"github/scope.go:40","msg":"configured Global configuration to [myorg/repo1] to scope Github token ","provider":"github","event-id":"a998700c-f84d-11ef-8b49-2d3f0e456aef","event-sha":"bf88751e90ec8897f550cc27b056c463a70999f1","event-type":"push","namespace":"mynamespace"}
{"level":"info","ts":"2025-03-03T16:36:33.200Z","logger":"pipelinesascode","caller":"github/scope.go:71","msg":"configured repo level configuration to [myorg/repo2] to scope Github token ","provider":"github","event-id":"a998700c-f84d-11ef-8b49-2d3f0e456aef","event-sha":"bf88751e90ec8897f550cc27b056c463a70999f1","event-type":"push","namespace":"mynamespace"}
{"level":"warn","ts":"2025-03-03T16:36:33.793Z","logger":"pipelinesascode","caller":"github/github.go:561","msg":"we have an invalid repository: `%s` or no access to it: %vmyorg/repo2GET https://api.github.com/repos/myorg/repo2: 404 Not Found []","provider":"github","event-id":"a998700c-f84d-11ef-8b49-2d3f0e456aef","event-sha":"bf88751e90ec8897f550cc27b056c463a70999f1","event-type":"push","namespace":"mynamespace"}
{"level":"info","ts":"2025-03-03T16:36:34.376Z","logger":"pipelinesascode","caller":"github/scope.go:84","msg":"Github token scope extended to [myorg/repo1 myorg/repo2 myorg/repo3] ","provider":"github","event-id":"a998700c-f84d-11ef-8b49-2d3f0e456aef","event-sha":"bf88751e90ec8897f550cc27b056c463a70999f1","event-type":"push","namespace":"mynamespace"}
global config:
secret-github-app-token-scoped: 'true'
secret-github-app-scope-extra-repos: myorg/repo1
repository definitions:
apiVersion: pipelinesascode.tekton.dev/v1alpha1
kind: Repository
metadata:
name: myorg-repo2
spec:
url: https://github.com/myorg/repo2
---
apiVersion: pipelinesascode.tekton.dev/v1alpha1
kind: Repository
metadata:
name: myorg-repo3
spec:
url: https://github.com/myorg/repo3
settings:
github_app_token_scope_repos:
- "myorg/repo2"
myorg/repo3 it's the one that received the event. The repositories definitions are in the same namespace.
I may have misunderstood something because it's the first time I dive into this code. In that case, let me know.
If the issues are confirmed, I'm also available to help resolve them.
Thank you!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.