search

octo-sts / app

A GitHub App that acts like a Security Token Service (STS) for the Github API
Apache License 2.0
126 stars 15 forks source link

Add webhook to validate STS configurations at pull request. #247

Closed wlynch closed 4 months ago

wlynch commented 5 months ago

Since we don't give any information at request time about why a STS policy is valid or not so that we don't leak details about the policy, this webhook will validate on the repo at pull request / push so the repo authors get feedback on potential config issues.

This changes does not set up GCLB, since this probably needs some more discussion for how we set this up to not conflict with the existing STS service.

mattmoor commented 4 months ago

Hey @wlynch, sorry for neglecting this. I wanted to get an image out for the app, and refactor the TF a bit to make deploying this to dev environments more tractable.

I'm going to TAL at this now, and try to refactor this on top of https://github.com/octo-sts/app/pull/284 to get this up in my dev environment 🤞

mattmoor commented 4 months ago

When I make edits in mattmoor/test-bed I'm seeing check_suite.requested events, which aren't handled. I'm gonna futz around a bit (it looks like we handle this in source enforce) 🤞

ref: https://github.com/mattmoor/test-bed/pull/1