Contributors should be able to publish CI results without permissions - Githubissues

oils-for-unix / oils

Oils is our upgrade path from bash to a better language and runtime. It's also for Python and JavaScript users who avoid shell!

http://www.oilshell.org/

Other

2.85k stars 158 forks source link

Contributors should be able to publish CI results without permissions #1038

Open andychu opened 2 years ago

andychu commented 2 years ago

Right now it requires an SSH key.

I think we need a simple CGI upload program that accepts 3 files: JSON, TSV, and ZIP. (honestly PHP is the best at this for multi-file uploads).

And then it will call the Python program to rewrite the index.

This will also solve #1015

We have to be careful about the atomic rewrite of the index.

andychu commented 2 years ago

We should also rename it to build.oilshell.org when we do this. Then we can be securely "multi-tenant" without multiple subdomains

Actually it is bad if anyone can publish HTML to our subdomain ... so we still need some kind of auth. I think a manual password file is OK.

Or maybe we can authenticate with github accounts somehow?

andychu commented 2 years ago

Need four passwords with access to publish into 4 directories:

sourcehut/
github/
circle-ci/
cirrus-ci/

And then rewrite the dashboard in that directory.

I guess that means contributors can get the password? As long as they can only add, it's mostly OK

andychu commented 2 years ago

Should we have a "docs" task?

See #1151

It would be nice if it could just run alone ... without the cpp and everything

andychu commented 2 years ago

We can simply add contributors to the repo, but I'd like them to be able to do so with less permissions ... I guess there should be a separate auth secret for travis-ci.oilshell.org ?

They don't need to be able to SSH and write files. The /status-api/github thing
But they should be able to publish JSON, TSV, and .wwz, and then rewrite the jobs index.
- So I think this could go in some sort of PHP script that does auth and invokes shell ...
- or really this would be a great use case for Oil ... maybe we should be ambitious and use a build of Oil
- It should be a simple CGI. But I also want logging? CGI logging is not good. I want a process ID and task ID etc.

andychu commented 2 years ago

This is a little messed up now, we have to add people explicitly as contributors

It would be nice to do this for PRs from anyone

andychu commented 2 years ago

https://oilshell.zulipchat.com/#narrow/stream/121539-oil-dev/topic/Contributors.20should.20be.20able.20to.20push.20to.20CI