search

StackStorm-Exchange / ci

Various scripts and utilities for StackStorm Exchange CI pipeline.
5 stars 18 forks source link

Enable pack "Build and Test" workflow without cloning && enable using fine-grained PAT #141

Closed cognifloyd closed 1 year ago

cognifloyd commented 1 year ago

This simplifies the workflow based on my comment here: https://github.com/StackStorm-Exchange/ci/pull/139#issuecomment-1360800869

Cloning repos can be occassionally flaky. For the index, that's not an issue because we do it so often, that waiting a few more minutes for the next run doesn't really matter. For this workflow, I would like to avoid cloning the pack repos somehow, so that this can be more reliable.

And it switches from gh workflow to gh api so that we can use fine-grained PATs.

cognifloyd commented 1 year ago

@mamercad and @armab wdyt?

cognifloyd commented 1 year ago

The last commit I added should, I hope, allow us to use a fine-grained PAT with this. I ran into some permissions issues with the bot token I created: https://github.com/StackStorm-Exchange/ci/actions/runs/3746070101/jobs/6361092828#step:6:69

  failed to enable workflow: HTTP 403: Must have admin rights to Repository. (https://api.github.com/repos/StackStorm-Exchange/stackstorm-acos/actions/workflows/16569224/enable)

But, as @mamercad noticed, graphql doesn't work with a fine-grained PAT, and gh workflow apparently is using graphql. :facepalm: https://github.com/StackStorm-Exchange/ci/actions/runs/3746417874/jobs/6361741025#step:6:59

gh: Personal access tokens with fine grained access do not support the GraphQL API (HTTP 401)

gh api explicitly does not use graphql. So, I'm hoping this will resolve those issues.

The fine-grained PAT must have an expiration date, so we will have to manually rotate this secret occasionally.

mamercad commented 1 year ago

@mamercad and @armab wdyt?

Looks good to me!