search

nodejs / package-maintenance

Repository for work for discussion of helping with maintenance of key packages in the ecosystem.
Other
407 stars 145 forks source link

Shared credentials #441

Open dominykas opened 3 years ago

dominykas commented 3 years ago

As part of work on wiby, I'll need to use a bot account - I do not want to add my personal token to the repo secrets, because there is no way to restrict tokens to a subset of repos.

wiby needs push (only push, not merge) access to the dependent repos (or their forks) to be able to kick off the tests (i.e. the test repos under the wiby-test org). We'll also be able to use that token to kick off the integration tests.

I figure that I should probably not be the only one with access to that bot account - but that leaves us with a problem of sharing credentials.

Any opinions on how to best do this? Would folks trust sops enough to keep the encrypted secrets in a repo? Possibly even a public one? I keep my PGP key on a Yubikey, not sure what everyone else does.

If we can make some decisions here, we can maybe also document some practices for others?

ljharb commented 3 years ago

Seems reasonable to make a bot account in the pkgjs org, and make a token for it?

credentials can be stored in node’s 1Password, and won’t likely be needed anyways beyond initial setup.

mhdawson commented 3 years ago

The build wg uses dotgpg to protect secrets but a private repo is used as well.

wesleytodd commented 3 years ago

There is an OpenJS Foundation lastpass account as well I think. This would be a great service for the foundation to offer IMO. I seem to remember hearing that another password app had free premium accounts for OSS projects, but I don't remember the name.

mhdawson commented 3 years ago

@brianwarner is this something we can use the Foundation lastpass account for?

travi commented 3 years ago

I seem to remember hearing that another password app had free premium accounts for OSS projects, but I don't remember the name.

this may have been the one that youre thinking of, since 1Password is one of the more popular managers: https://github.com/1Password/1password-teams-open-source

brianwarner commented 3 years ago

Yes definitely, find me on slack and we can coordinate on escrowing the credentials. We have LastPass Enterprise, and I can share creds out to anyone who uses the free version.

dominykas commented 3 years ago

Seems reasonable to make a bot account in the pkgjs org, and make a token for it?

Are there org level bot accounts available in GH? I thought they only have real user accounts? Which means that it's not just the password that needs to be shared, but it also needs to be associated with an email...

That said, I created the @wiby-bot account (strictly speaking, in violation of GH rules, as they only allow one bot account per person, and I already have one) to unblock myself and we can sort out the details later.

credentials can be stored in node’s 1Password, and won’t likely be needed anyways beyond initial setup.

The account is necessary to be able to generate PATs. Adding access in new repos would usually require new tokens (as we shouldn't be keeping them backed up and they're not readable once saved as secrets), which means logging in again, while not frequent, will be necessary.

mhdawson commented 3 years ago

For email we can PR into https://github.com/nodejs/email/blob/master/iojs.org/aliases.json a new alias called:

package-maintenance-admin-members for an email.