Skip to content

Request permission to create personal and Jenkins tokens for github-bot add Secrets to nodejs/reliability and nodejs/node #523

Closed
@mmarchini

Description

@mmarchini

I noticed we don't have a policy to create tokens for github-bot nor do we have a policy to add Secrets (which are used by Actions) to repositories, so I'll assume the same requirements we have for creating GitHub Apps (because functionally creating token + adding secrets is similar to creating an App). This issue bundles a few requests:

For nodejs/reliability

  • Create a Jenkins token for @nodejs-github-bot
  • Create a personal GitHub token for @nodejs-github-bot with repo.public_repo and user.read:user scopes
  • Add those secrets to the nodejs/reliability repository: JENKINS_TOKEN (with the Jenkins token generated above), USER_TOKEN (with the personal access token generated above) and USER_NAME (with nodejs-github-bot)

These tokens will be used by the nodejs/reliability Actions to generate daily reports of all failures in our CI. The reports are generated via ncu-ci.

Ref: nodejs/reliability#24 and nodejs/reliability#25

For nodejs/node

  • Create a Jenkins token for @nodejs-github-bot
  • Create a personal GitHub token for @nodejs-github-bot with repo.public_repo and user.read:user scopes
  • Add those secrets to the nodejs/reliability repository: JENKINS_TOKEN (with the Jenkins token generated above), GH_USER_TOKEN (with the personal access token generated above) and GH_USER_NAME (with nodejs-github-bot)

These tokens will be available for any Actions running on nodejs/node, except for Actions running on the scope of Pull Requests from forks (so a PR with a malicious actions does not have access to those tokens). Initially, these tokens are intended to be used on Commit Queue and Start CI via Label Actions, but it will be available for other Actions as well.

Ref: Commit Queue and Start CI via Label (both PRs are blocked until the Secrets are added to the repository).

cc @nodejs/tsc @nodejs/community-committee

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions