jpoehnelt / secrets-sync-action

A Github Action that can sync secrets from one repository to many others.
https://github.com/marketplace/actions/secrets-sync-action
Apache License 2.0
314 stars 92 forks source link

can't use regex in private org repo #4

Closed chiefjester closed 4 years ago

chiefjester commented 4 years ago

Hi,

Thanks for making this! 👋 The API seems to be straightforward. I'm trying to use regex in my private org, and it seems to be not finding it.

For example, if I have these repositories.

username/foo-bar org/foo-bar org/foo-baz

and I have these at my repositories

        REPOSITORIES: |
           username/foo.*
           org/foo.*

Only the username repo is found. Also, I do have access to those repositories, because if I use the full name, this action can find the private org repositories.

chiefjester commented 4 years ago

@jpoehnelt nevermind seems like I was using 1.0.0, I'll open up a PR, the example was pointing to 1.0.0

chiefjester commented 4 years ago

@jpoehnelt okay, now it doesn't find my own repo 😥. It can successfully find my org repositories, but it won't find my personal ones?

To be clear, my org has 581 repositories, and I have 191 from my account. I checked the debug statement, I'm only seeing 259 repositories from my org. the rest are from other organizations, but none where I own.

jpoehnelt commented 4 years ago

I'm only seeing 259 repositories from my org. the rest are from other organizations, but none where I own.

It only lists repositories where you(or the bot token) are an owner or collaborator. It does not include if you are just a member. See https://developer.github.com/v3/repos/#list-repositories-for-the-authenticated-user. Could it be that?

chiefjester commented 4 years ago

hi @jpoehnelt, Thank you for merging. 🤝 I apologize if I was a bit vague 🙏, what I'm saying is I am seeing repositories of my org but not under my username. So not a single repository under my username, including my dotfiles which are public is not visible, it just won't print it.

for example: https://github.com/thisguychris/dotfiles

This repo is not listed however I write the regex under the repositories section. I also have administrative privileges on my organization, however, I can only see half of the repositories?

Also, I haven't dig in the code, but how do you handle pagination, are you fetching on the first hundred or do you traverse to all repositories?

jpoehnelt commented 4 years ago

@thisguychris see #6 for hardcoded limit. I'll remove this.

github-actions[bot] commented 4 years ago

:tada: This issue has been resolved in version 1.1.4 :tada:

The release is available on GitHub release

Your semantic-release bot :package::rocket:

jpoehnelt commented 4 years ago

@thisguychris Let me know if you still have issues and if you run into any rate limit problems. Thanks for reporting.

chiefjester commented 4 years ago

hey @jpoehnelt! Thank you for issuing a fix so fast. So far as with my testing, it is now able to see all my repositories on all organizations and under my username.

I'll report soon if I hit some API limits, but this is far better workflow than the one I'm using. The ability to use regex is brilliant! I could potentially re-write the repo with some suffix like -secrets or something, and I'll just run this and it'll sync. Beautiful!

Just a side question, how do you deal with potential one-offs, like if you want to sync ENV_X to only selected repositories?

jpoehnelt commented 4 years ago

Just a side question, how do you deal with potential one-offs, like if you want to sync ENV_X to only selected repositories?

I would just have another job or step in the workflow and specify the regex as ^org/repository$ for a single respository.

In my use case I have repositories named by <org>/<language>-<api>. So for example if I need to sync some JavaScript specific secrets, I have an action for all the repos with something like: ^myorg/js-.*$.

chiefjester commented 4 years ago

That's brilliant, silly me 😅. As you said, I just realize you could just have multiple jobs using the same action. Thanks for the suggestion.