Skip to content

chore(ci): use github app for tokens #6534

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Nov 28, 2024
Merged

chore(ci): use github app for tokens #6534

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
19e3a98
chore(ci): use github app for tokens
nirinchev Nov 27, 2024
5fd7bd8
Use @main
nirinchev Nov 27, 2024
ea854e8
Update contributing.md
nirinchev Nov 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 1 addition & 12 deletions .github/workflows/authors-and-third-party-notices.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,18 +16,12 @@ jobs:
HADRON_DISTRIBUTION: compass
steps:
- name: Create Github App Token
uses: actions/create-github-app-token@v1
uses: mongodb-js/devtools-shared/actions/setup-bot-token@main
id: app-token
with:
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}

- name: Get GitHub App User ID
Copy link
Collaborator Author

@nirinchev nirinchev Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The removed steps in this file have been moved to our setup-bot-token action.

id: get-user-id
run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
env:
GH_TOKEN: ${{ steps.app-token.outputs.token }}

- uses: actions/checkout@v4
with:
# don't checkout a detatched HEAD
Expand All @@ -38,11 +32,6 @@ jobs:
fetch-depth: "0"
token: ${{ steps.app-token.outputs.token }}

- name: Set up Git
run: |
git config --global user.name '${{ steps.app-token.outputs.app-slug }}[bot]'
git config --global user.email '${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com>'

- uses: actions/setup-node@v4
with:
node-version: 20.16.0
Expand Down
35 changes: 16 additions & 19 deletions .github/workflows/bump-packages.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,24 +10,22 @@ jobs:
name: Bump packages
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Create Github App Token
uses: mongodb-js/devtools-shared/actions/setup-bot-token@main
id: app-token
with:
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}

- uses: actions/checkout@v4
with:
# don't checkout a detatched HEAD
ref: ${{ github.head_ref }}

# this is important so git log can pick up on
# the whole history to generate the list of AUTHORS
fetch-depth: '0'
Copy link
Collaborator Author

@nirinchev nirinchev Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We're not updating AUTHORS in this workflow, so this seems unnecessary


- name: Setup git
run: |
git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
git config --local user.name "github-actions[bot]"

- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: 20.16.0
cache: 'npm'
cache: "npm"

- name: Install npm@10.2.4
run: |
Expand All @@ -40,21 +38,20 @@ jobs:

- name: Bump packages
env:
LAST_BUMP_COMMIT_MESSAGE: 'chore(release): bump package versions'
SKIP_BUMP_PACKAGES: 'mongodb-compass'
LAST_BUMP_COMMIT_MESSAGE: "chore(release): bump package versions"
SKIP_BUMP_PACKAGES: "mongodb-compass"
run: |
npm run bump-packages
git add .
git commit --no-allow-empty -m "$LAST_BUMP_COMMIT_MESSAGE" || true

- name: Create Pull Request
id: cpr
uses: peter-evans/create-pull-request@v6
uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # 7.0.5
Copy link
Collaborator Author

@nirinchev nirinchev Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For 3rd party packages, we should use git commit shas instead of version tags as those can be force pushed.

Copy link
Collaborator

@gribnoysup gribnoysup Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a documentation for this that we can point to somewhere around this code? It's not obvious and would be very easy to revert back over time without noting why we are doing this

Copy link
Collaborator Author

@nirinchev nirinchev Nov 27, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's part of the general security hardening recommendations for actions: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

While I don't have reasons to mistrust Peter, a rule of thumb I tend to follow is to use versions for actions by corporations such as microsoft, github, amazon, where there's strong expectation that they have security practices in place that would prevent access to their code. And for everything else, even if it's a popular action, I pin the commit sha.

Copy link
Collaborator

@gribnoysup gribnoysup Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cool, so can we add this link somewhere around this line (or any other place you think is appropriate) so that when someone is going over this code in the future and is unsure why exactly this is set to a hash instead of a version the rule is still followed?

Copy link
Collaborator Author

@nirinchev nirinchev Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we should be adding comments as the commit sha usage should be the default for any 3rd party action. I did drop a message on slack though to bring more attention to this. I've also updated CONTRIBUTING.md with a section highlighting a few of the security best practices that also links to the full doc.

with:
token: ${{ secrets.SVC_DEVTOOLSBOT_TOKEN }}
commit-message: 'chore(release): bump package versions'
token: ${{ steps.app-token.outputs.token }}
commit-message: "chore(release): bump package versions"
branch: ci/bump-packages
title: 'chore(release): bump package versions'
title: "chore(release): bump package versions"
labels: no-title-validation
body: |
- Bump package versions
11 changes: 8 additions & 3 deletions .github/workflows/merge-bump-packages-pr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,18 +3,23 @@ on:
workflow_dispatch:
schedule:
# Each Tuesday at 5 AM UTC
- cron: '0 5 * * 2'
- cron: "0 5 * * 2"

jobs:
merge_bump_packages_pr:
name: Merge bump packages PR
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
Copy link
Collaborator Author

@nirinchev nirinchev Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checkout seems unnecessary here as we don't use anything from the repo

- name: Create Github App Token
uses: mongodb-js/devtools-shared/actions/setup-bot-token@main
id: app-token
with:
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}

- name: Merge PR
env:
GITHUB_TOKEN: ${{ secrets.SVC_DEVTOOLSBOT_TOKEN }}
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
set -e
PR_NUMBER=$(gh pr list -s open --head=ci/bump-packages --limit=1 --json number | jq '.[0].number')
Expand Down
42 changes: 19 additions & 23 deletions .github/workflows/update-electron.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,44 +11,40 @@ jobs:
name: Update Electron
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Create Github App Token
uses: mongodb-js/devtools-shared/actions/setup-bot-token@main
id: app-token
with:
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}

- uses: actions/checkout@v4
with:
# don't checkout a detatched HEAD
ref: ${{ github.head_ref }}

# this is important so git log can pick up on
# the whole history to generate the list of AUTHORS
fetch-depth: '0'

- name: Setup git
run: |
git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
git config --local user.name "github-actions[bot]"
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: 20.16.0
cache: 'npm'
cache: "npm"

- name: Install npm@10.2.4
run: |
npm install -g npm@10.2.4

- name: Install Dependencies
run: |
npm -v
npm ci
run: npm ci

- name: Bump packages
run: |
node scripts/update-electron.js
git add .
git commit --no-allow-empty -m "chore(deps): update electron" || true
Comment on lines -42 to -43
Copy link
Collaborator Author

@nirinchev nirinchev Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The create-pull-request action will automatically add and commit, so no need to do it here

run: node scripts/update-electron.js

- name: Create Pull Request
id: cpr
uses: peter-evans/create-pull-request@v6
uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # 7.0.5
with:
token: ${{ secrets.SVC_DEVTOOLSBOT_TOKEN }}
commit-message: 'chore(deps): update electron'
token: ${{ steps.app-token.outputs.token }}
commit-message: "chore(deps): update electron"
branch: ci/update-electron
title: 'chore(deps): update electron'
title: "chore(deps): update electron"
labels: no-title-validation
body: |
- Update electron
10 changes: 9 additions & 1 deletion CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ In particular each change to the `main` branch is analyzed to calculate a new ve

Merging that PR will trigger another CI job that will publish to NPM any package which version is not yet present on the registry.

The version of packages is calculated following conventional bumps: See https://github.com/mongodb-js/devtools-shared/tree/main/packages/bump-monorepo-packages for details.
The version of packages is calculated following conventional bumps: See https://github.com/mongodb-js/devtools-shared/tree/main/packages/monorepo-tools for details.
Copy link
Collaborator Author

@nirinchev nirinchev Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a drive-by - noticed the link is outdated


## Add / Update / Remove Dependencies in Packages

Expand All @@ -115,6 +115,14 @@ npm run create-workspace [workspace name]

This will do all the initial workspace bootstrapping for you, ensuring that your package has all the standard configs set up and ready, and all the npm scripts aligned with other packages in the monorepo, which is important to get the most out of all the provided helpers in this repository (like `npm run check-changed` commands or to make sure that your tests will not immediately fail in CI because of the test timeout being too small)

## Using Github Actions
Copy link
Collaborator

@gribnoysup gribnoysup Nov 28, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice writeup, thanks


Github actions offers an easy way to create workflows that run various automated checks. While our main CI system is Evergreen, we have a number of auxiliary workflows configured to run using github actions. While adding new workflows or updating existing ones, it's important that we follow [the security hardening guidelines](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions) by Github. Those can change over time, so be sure to periodically review them to make sure we're not using insecure workflows. Some notable highlights to pay special attention to are:
1. Avoid using tag or branch refs for untrusted 3rd party actions. Those can easily be recreated by malicious actors and introduce supply chain attacks. As a rule of thumb, first party actions are considered actions by MongoDB, Github, Microsoft, or the primary maintainer of a particular ecosystem - e.g. Amazon for AWS. When using a 3rd party action, always use the full git commit sha as the ref to checkout.
2. Be extra vigilant when using user-supplied data, such as branch name or PR title in scripts as that opens up the possibility of script injection attacks. Instead, prefer to use js actions to achieve the same result or sanitize the input before using it in a script.
3. Never commit secrets in the workflow file directly - instead use github secrets to store them securely at the repo/org level.
4. Avoid using repo-level secrets that grant access to deployment/publishing resources. Instead prefer to store these as environment secrets and ensure the correct environments protections are in place.

## Caveats

### `hdiutil: couldn't unmount "diskn" - Resource busy` or Similar `hdiutil` Errors
Expand Down
Loading