Reduce usage of admin token

jupyter-server / jupyter_releaser

A set of helper scripts and GitHub Actions to aid in automated releases of Python and npm packages.

https://jupyter-releaser.readthedocs.io/en/latest/

Other

45 stars 64 forks source link

Reduce usage of admin token #545

Closed blink1073 closed 5 months ago

blink1073 commented 6 months ago

[x] Add a separate personal_access_token that is only used for the direct push to the target branch, otherwise use the user's token.
[ ] Add docs that recommend the use of a fine-grained access token in an environment for publish_release
[ ] Add test for pr ci trigger and personal access token
[ ] Test against a scratch repo

blink1073 commented 5 months ago

Okay, it turns out this truly isn't possible if branch protections are on. You get something like:

remote: error: GH006: Protected branch update failed for refs/heads/main.
remote: error: Changes must be made through a pull request. Required status check "test" is expected.

Even if the user running the workflow is an admin.

https://github.com/blink1073/test-python-project/actions/runs/7521308670/job/20471980190

blink1073 commented 5 months ago

Back to the drawing board:

Each org enables Fine-grained personal access tokens.
Each repo has an admin-managed scoped access token that must expire every 90 days
Any admin can go and create a new access token (or regenerate the old one) and update the secret in the repo

blink1073 commented 5 months ago

TODO: remove personal_access_token in favor of using an environment secret and using the same token for the whole publish step - this makes things easier on both ends, and the token is still needed either way.

ElioDiNino commented 5 months ago

Is there any way to get the current workflows to work while branch protections are enabled? I can't seem to get it working since skipping just the commit with the changelog and package.json update is coupled with the new tag push.

blink1073 commented 5 months ago

Hi @ElioDiNino, if you ADMIN_GITHUB_TOKEN has admin permissions on the repo and you haven't selected this option it should work:

ElioDiNino commented 5 months ago

Hi @ElioDiNino, if you ADMIN_GITHUB_TOKEN has admin permissions on the repo and you haven't selected this option it should work:

Hmm okay, I will try disabling that thanks. I am actually using a GitHub app and generating a token for it in place of using a PAT so that may also be causing issues

blink1073 commented 5 months ago

This picked up some conflicts and has some work that needs to be removed, going to start a fresh PR.