tektoncd / tektoncd/pipelines-as-code

Github scoped token generation does not work at repository level

Open
#1,979 2 comments 0 reactions 1 assignee View on GitHub

@zakisk is already working on this.

Since Mar 6, 2025.

bug priority/high
Dominant language
Go
Stars
214
Forks
144
Avg merge
2d 11h
Merged PRs (30d)
27

Description

Hi!
In contrary to what the doc says, the list of github_app_token_scope_repos specified in a Repository custom resource it's ignored if the secret-github-app-token-scoped setting is enabled.

This is for two reasons:

  1. There is a check that fails on purpose if the secret-github-app-scope-extra-repos is empty, but it's not supposed to. In fact one might want to broaden the scope of the token only at repository level.
  2. Even if the case before does not occur because there are some secret-github-app-scope-extra-repos set, while generating the token we'll get (apart from the wrongfully formatted log warning, see the example at the end) a 404 from github because the token that it's being used in the context is scoped only for the secret-github-app-scope-extra-repos

Additionally, the fact that the failures in the generation of the token are ignored causes the confusing effect of a log that asserts later in the code that it worked for all the repos either way.

Example of output:

{"level":"info","ts":"2025-03-03T16:36:32.544Z","logger":"pipelinesascode","caller":"github/parse_payload.go:200","msg":"Github token scope extended to [myorg/repo1] keeping SecretGHAppRepoScoped to true","provider":"github","event-id":"a998700c-f84d-11ef-8b49-2d3f0e456aef"}
{"level":"info","ts":"2025-03-03T16:36:33.193Z","logger":"pipelinesascode","caller":"github/scope.go:40","msg":"configured Global configuration to [myorg/repo1] to scope Github token ","provider":"github","event-id":"a998700c-f84d-11ef-8b49-2d3f0e456aef","event-sha":"bf88751e90ec8897f550cc27b056c463a70999f1","event-type":"push","namespace":"mynamespace"}
{"level":"info","ts":"2025-03-03T16:36:33.200Z","logger":"pipelinesascode","caller":"github/scope.go:71","msg":"configured repo level configuration to [myorg/repo2] to scope Github token ","provider":"github","event-id":"a998700c-f84d-11ef-8b49-2d3f0e456aef","event-sha":"bf88751e90ec8897f550cc27b056c463a70999f1","event-type":"push","namespace":"mynamespace"}
{"level":"warn","ts":"2025-03-03T16:36:33.793Z","logger":"pipelinesascode","caller":"github/github.go:561","msg":"we have an invalid repository: `%s` or no access to it: %vmyorg/repo2GET https://api.github.com/repos/myorg/repo2: 404 Not Found []","provider":"github","event-id":"a998700c-f84d-11ef-8b49-2d3f0e456aef","event-sha":"bf88751e90ec8897f550cc27b056c463a70999f1","event-type":"push","namespace":"mynamespace"}
{"level":"info","ts":"2025-03-03T16:36:34.376Z","logger":"pipelinesascode","caller":"github/scope.go:84","msg":"Github token scope extended to [myorg/repo1 myorg/repo2 myorg/repo3] ","provider":"github","event-id":"a998700c-f84d-11ef-8b49-2d3f0e456aef","event-sha":"bf88751e90ec8897f550cc27b056c463a70999f1","event-type":"push","namespace":"mynamespace"}

global config:

secret-github-app-token-scoped: 'true'
secret-github-app-scope-extra-repos: myorg/repo1

repository definitions:

apiVersion: pipelinesascode.tekton.dev/v1alpha1
kind: Repository
metadata:
  name: myorg-repo2
spec:
  url: https://github.com/myorg/repo2
---
apiVersion: pipelinesascode.tekton.dev/v1alpha1
kind: Repository
metadata:
  name: myorg-repo3
spec:
  url: https://github.com/myorg/repo3
  settings:
    github_app_token_scope_repos:
    - "myorg/repo2"

myorg/repo3 it's the one that received the event. The repositories definitions are in the same namespace.

I may have misunderstood something because it's the first time I dive into this code. In that case, let me know.
If the issues are confirmed, I'm also available to help resolve them.
Thank you!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.