Open yarikoptic opened 10 months ago
FWIW https://github.com/dependabot is a great bot/project/resource to checkout .Since it is quite modular and configurable, I even started to wonder if we could build on top of it even if for some jobs...
The JOSS editorial-bot https://github.com/openjournals/buffy might also be a good bot/project/resource to check out.
Preliminary research:
At a high level, setting up a GitHub bot (properly known as a "GitHub App") involves building a publicly-accessible HTTP server and configuring GitHub to send requests called "webhooks" to the server whenever certain events happen. If the server receives an actionable webhook, it takes action via the normal GitHub APIs.
The steps for creating an app seem simple enough, but I'd find it hard to believe if no one has yet created a generic GitHub App framework in Python to save us from having to write everything from scratch.
A GitHub App can be public or private.
A private app can only be associated with at most one organization, so if we want to use this bot in multiple organizations (e.g., dandisets
and dandizarrs
), we would have to duplicate the setup on the GitHub end in order to create two identical apps in different organizations pointing to the same server.
Public apps can be installed in any number of organizations and by any GitHub user, though if we don't choose to put it on the Marketplace, I'm not sure how anyone else would find it.
Next step: Search PyPI and elsewhere for pre-existing GitHub App frameworks
FWIW https://github.com/dependabot is a great bot/project/resource to checkout .Since it is quite modular and configurable, I even started to wonder if we could build on top of it even if for some jobs...
I'm pretty sure that Dependabot's modularity & configurability is all oriented around updating dependencies; e.g., you can add a module for looking up packages in a new package source, but you can't add a module for operating on dandisets. Also, it's written in Ruby, which I don't know and I don't think anyone else on the team knows.
[Work in Progress]
Features to judge packages on:
X-GitHub-Delivery
headers [1] [2]Relevant (to varying degrees) Python packages found so far:
GitHub apps written in Python:
DataLad dandisets are not "sources", they are automagically updated by a cron service running on drogon. As such we should not give any write permissions to original authors/owners of the dandisets as known to the DANDI system.
Only DANDI archive has information about which users have write access to the original dandiset, and thus should be capable e.g. to
Triage
role. E.g.@dandibot add @login1 @login2 to the dandiset
,@dandibot remove @login1 @login2 from the dandiset
(#360)@dandibot accept PR
It will be responsibility of the bot to first verify that the author of the command is among authors of the dandiset to operate on the command.
Such bot service might also help to show/seek confirmation from the authors for some scheduled/mass maintenance tasks etc as we mind stormed with @rly during ODIN, e.g.
.nwb
files:Some extra "cron" jobs which might need to be performed but not necessary need to be a part of "bot" I guess:
TODOs (yet to be finalized)
refs: