chore(gocd): use GitHub App credentials - #600
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #600 +/- ##
==========================================
+ Coverage 87.99% 88.51% +0.51%
==========================================
Files 96 104 +8
Lines 15956 17237 +1281
==========================================
+ Hits 14041 15257 +1216
- Misses 1915 1980 +65
☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
jan-auer
left a comment
jan-auer
left a comment
There was a problem hiding this comment.
Unblocking for when this is ready to merge
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}', | ||
| GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}', |
There was a problem hiding this comment.
Bug: The switch to GitHub App credentials may be incompatible with the pinned version of the getsentry/gocd-jsonnet dependency (v3.0.7), potentially breaking the pipeline's check reporting stage.
Severity: HIGH
Suggested Fix
Verify that version 3.0.7 of the getsentry/gocd-jsonnet dependency supports authentication using GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY. If it does not, consider upgrading the dependency to a compatible version or implementing a fallback mechanism to ensure backward compatibility.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: gocd/templates/libs/utils.libsonnet#L21-L22
Potential issue: The code replaces the `GITHUB_TOKEN` environment variable with
`GITHUB_APP_ID` and `GITHUB_APP_PRIVATE_KEY` for GitHub authentication. However, the
pipeline relies on an external dependency, `getsentry/gocd-jsonnet` pinned to v3.0.7,
which consumes these variables. There is a risk that this specific version of the
dependency does not support authentication via GitHub Apps and only expects
`GITHUB_TOKEN`. If this is the case, the `checks-githubactions-checkruns` binary will
fail to authenticate with GitHub, causing the `checks` stage of the pipeline to fail at
runtime. This would break the pipeline's ability to report check-run statuses.
Did we get this right? 👍 / 👎 to inform future reviews.
| #!/bin/bash | ||
|
|
||
| checks-githubactions-checkruns \ | ||
| checks-githubactions-checkruns2 \ |
There was a problem hiding this comment.
Bug: The script now calls checks-githubactions-checkruns2 and uses new auth variables. This assumes the binary is deployed and compatible, which isn't guaranteed by the code changes.
Severity: HIGH
Suggested Fix
Add a fallback mechanism to use the old binary if the new one is not found. Alternatively, add error handling to provide a clear message if checks-githubactions-checkruns2 is missing or fails. Consider adding a check for the binary's existence at the start of the script. It would also be beneficial to document the deployment requirements for this new binary within the repository.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: gocd/templates/bash/github-check-runs.sh#L3
Potential issue: The script `github-check-runs.sh` is updated to call a new binary,
`checks-githubactions-checkruns2`, and the configuration in `utils.libsonnet` switches
from using `GITHUB_TOKEN` to `GITHUB_APP_ID` and `GITHUB_APP_PRIVATE_KEY`. This change
relies on the `checks-githubactions-checkruns2` binary being present in the execution
environment's `PATH` and being compatible with the new authentication environment
variables. If the binary is not deployed, is named differently, or expects different
variables, the GoCD check-run stages will fail, potentially with a "command not found"
error, which could block all deployments.
Also affects:
gocd/templates/libs/utils.libsonnet:21~22
2 participants
Replace GoCD GitHub token references with GitHub App credentials.