feat: undeploy-my-kibana #140

v1v · 2024-10-06T19:20:25Z

What

An initial attempt to move away from a finer-grained token and use ephemeral tokens.

Further details

It's difficult to migrate https:/elastic/apm-pipeline-library/tree/main/.github/actions/undeploy-my-kibana to use the GH App ephemeral tokens.

It requires different permissions to access the members of a given org, so it can add an extra validation if the PR author is a member of Elastic.

I decided to remove that because it will require further complicated code, and the GitHub labels filtering in the workflows are good enough:

https:/elastic/kibana/blob/8d83a075f6228bb5a6e35a9bb4654fe29cee0cff/.github/workflows/undeploy-my-kibana.yml#L21

the github label should be the gatekeeper

…tory.defaultBranchRef)

v1v · 2024-10-06T19:52:09Z

oblt-cli/undeploy-my-kibana/action.yml

+ github-token:
+ description: 'The GitHub Personal Access Token.'
+ required: false
+ github-app-id:
+ description: 'The GitHub App ID to generate the ephemeral token.'
+ required: false
+ github-app-private-key:
+ description: 'The GitHub App Private Key to generate the ephemeral token.'
+ required: false


I don't know whether keeping both approaches might be good... WDYT?

I think the GitHub app credentials are only a temporary solution. I understand the benefit right now, but I don't think we want GitHub app credentials as GitHub secrets in the future, as they are very powerful.

Also, as we know, a new approach is on the horizon already.

Hence, we should not add it here and just pass the GH token from the output of the tibdex action.

I think it's even more protected this implementation since it pretty much generates the token with the expected permissions.
While if using the other approach implies the consumers will need to know what kind of permissions need be generated.

I somehow feel this approach, even if temporary, will facilitate the consumers since they don't need to know much. WDYT?

Good point.

On the other hand, there is only one consumer. https:/search?q=org%3Aelastic+elastic%2Fapm-pipeline-library%2F.github%2Factions%2Fundeploy-my-kibana+%28path%3A**%2F*.yml+OR+path%3A**%2F*.yaml%29&type=code

And it's basically us maintaining it. (this may be true also for other oblt-actions, but I think this one is even more true for this one)

I'm also torn now.

The only thing I can think of is that we don't have to remove the inputs in a breaking change in the future if we don't add them in the first place.

I agree about the breaking change. I initially didn't implement see dcb19ad, but to a certain extent, I found it a bit complicated when I wrote the tests, see d0db167 - it's much cleaner.

In any case, we can support both cases and then once we have the new GH ephemeral token, the change will be pretty much using the github-token input, so we won't need to care about the other two input parameters, we just won't use them

v1v · 2024-10-06T19:52:30Z

oblt-cli/undeploy-my-kibana/action.yml

+
+ ### Further details
+
+ Caused by @${{ env.PR_AUTHOR }} in https:/${{ env.REPO }}/pull/${{ env.PR }}


I think I might also include the workflow URL that triggered this action

…ibana * upstream/main: (51 commits) deps: Bump oblt-cli version to 7.6.2 (elastic#139) feat: undeploy-my-kibana (elastic#140) build(deps): bump the github-actions group across 2 directories with 2 updates (elastic#141) build(deps): bump the github-actions group across 6 directories with 1 update (elastic#138) chore: deps(oblt-cli): Bump oblt-cli version to 7.5.24 (elastic#137) feat: support wait for maven central (elastic#133) feat: migrate is-member-elastic-org (elastic#135) deps: Bump oblt-cli version to 7.5.22 (elastic#131) deps(updatecli): bump all policies (elastic#130) ci: use GitHub app for ephemeral tokens (elastic#129) Deprecate the `project-id` input in `google/auth` action. (elastic#124) deps(updatecli): bump all policies (elastic#122) chore: deps(oblt-cli): Bump oblt-cli version to 7.5.21 (elastic#121) build(deps): bump the github-actions group across 11 directories with 4 updates (elastic#125) github-action: use ephemeral tokens with the required permissions (elastic#113) feat(github): validate-comment (elastic#120) feat(pre-commit): migrate from apm-pipeline-library (elastic#119) deps(updatecli): bump all policies (elastic#117) feat(await-maven-artifact): migrate from https:/elastic/apm-pipeline-library (elastic#118) Add `test-report` action (elastic#114) ...

v1v · 2024-10-07T22:03:02Z

Interestingly, e2e tests work but production workflow doesn't work:

https:/elastic/kibana/actions?query=is%3Afailure

Run tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
  with:
    app_id: ***
    private_key: ***
    permissions: {
    "contents": "read",
    "issues": "write"
  }
    repositories: ["observability-test-environments"]
    github_api_url: https://api.github.com
    installation_retrieval_mode: repository
    installation_retrieval_payload: elastic/kibana
    revoke: true
Error: Could not create installation access token.
    at createInstallationAccessToken (file:///home/runner/work/_actions/tibdex/github-app-token/3beb63f4bd073e614[8](https:/elastic/kibana/actions/runs/11223820283/job/31199282113?pr=195312#step:2:9)2598c45c71c101[9](https:/elastic/kibana/actions/runs/11223820283/job/31199282113?pr=195312#step:2:10)b59b73a/dist/main/index.js:9:86267)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async file:///home/runner/work/_actions/tibdex/github-app-token/3beb63f4bd073e61482598c45c71c[10](https:/elastic/kibana/actions/runs/11223820283/job/31199282113?pr=195312#step:2:11)19b59b73a/dist/main/index.js:9:87518
    at async run (file:///home/runner/work/_actions/tibdex/github-app-token/3beb63f4bd073e61482598c45c71c1019b59b73a/dist/main/index.js:9:888[11](https:/elastic/kibana/actions/runs/11223820283/job/31199282113?pr=195312#step:2:12))
    at async file:///home/runner/work/_actions/tibdex/github-app-token/3beb63f4bd073e6[14](https:/elastic/kibana/actions/runs/11223820283/job/31199282113?pr=195312#step:2:15)82598c45c71c1019b59b73a/dist/main/index.js:9:87468 {
  [cause]: Error: Could not retrieve installation.
      at retrieveInstallationId (file:///home/runner/work/_actions/tibdex/github-app-token/3beb63f4bd073e61482598c45c71c1019b59b73a/dist/main/index.js:9:87232)
      at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
      at async createInstallationAccessToken (file:///home/runner/work/_actions/tibdex/github-app-token/3beb63f4bd073e61482598c45c71c1019b59b73a/dist/main/index.js:9:86069)
      ... 2 lines matching cause stack trace ...
      at async file:///home/runner/work/_actions/tibdex/github-app-token/3beb63f4bd073e61482598c45c71c1019b59b73a/dist/main/index.js:9:87468 {
    [cause]: RequestError [HttpError]: Not Found
        at file:///home/runner/work/_actions/tibdex/github-app-token/3beb63f4bd073e61482598c45c71c1019b59b73a/dist/main/index.js:1:64431
        at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
        at async retrieveInstallationId (file:///home/runner/work/_actions/tibdex/github-app-token/3beb63f4bd073e61482598c45c71c1019b59b73a/dist/main/index.js:9:87014)
        at async createInstallationAccessToken (file:///home/runner/work/_actions/tibdex/github-app-token/3beb63f4bd073e61482598c45c71c1019b59b73a/dist/main/index.js:9:86069)
        at async file:///home/runner/work/_actions/tibdex/github-app-token/3beb63f4bd073e61482598c45c71c1019b59b73a/dist/main/index.js:9:875[18](https:/elastic/kibana/actions/runs/11223820283/job/31199282113?pr=195312#step:2:19)
        at async run (file:///home/runner/work/_actions/tibdex/github-app-token/3beb63f4bd073e61482598c45c71c10[19](https:/elastic/kibana/actions/runs/11223820283/job/31199282113?pr=195312#step:2:20)b59b73a/dist/main/index.js:9:88811)
        at async file:///home/runner/work/_actions/tibdex/github-app-token/3beb63f4bd073e61482598c45c71c1019b59b73a/dist/main/index.js:9:87468 {
      status: 404,
      response: [Object],
      request: [Object]
    }
  }
}

I cannot understand what's the different between these two:

https:/elastic/oblt-actions/actions/runs/11213506268/job/31166699157?pr=140

Run tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
  with:
    app_id: ***
    private_key: ***
    permissions: {
    "contents": "read",
    "issues": "write"
  }
    repositories: ["observability-test-environments"]
    github_api_url: https://api.github.com/
    installation_retrieval_mode: repository
    installation_retrieval_payload: elastic/oblt-actions
    revoke: true

unless the checkout step is somehow related ?!

v1v · 2024-10-07T22:05:48Z

aha

https:/tibdex/github-app-token/blob/3eb77c7243b85c65e84acfa93fdbac02fb6bd532/action.yml#L11-L20

v1v · 2024-10-08T08:00:29Z

and it works as expected now

https:/elastic/kibana/actions/runs/11231085849/job/31219753582?pr=190211

v1v added 2 commits October 6, 2024 21:16

feat: undeploy-my-kibana

08ac2e0

test for undeploy-my-kibana

8463cb5

v1v self-assigned this Oct 6, 2024

v1v added the changelog:enhancement When you enhance an existing feature label Oct 6, 2024

v1v added 6 commits October 6, 2024 21:25

different conditional

6143a63

test kibana instead

9602794

we cannot use a gh app without enough permissions

81cd567

the github label should be the gatekeeper

trying to fix GraphQL: Resource not accessible by integration (reposi…

1a6f74d

…tory.defaultBranchRef)

simplify with github app

dcb19ad

test no params and all params

d0db167

v1v marked this pull request as ready for review October 6, 2024 19:51

v1v commented Oct 6, 2024

View reviewed changes

reakaleek approved these changes Oct 7, 2024

View reviewed changes

add workflow

418458c

v1v enabled auto-merge (squash) October 7, 2024 10:21

Merge branch 'main' into feature/undeploy-kibana

076b9eb

v1v merged commit fb0b825 into main Oct 7, 2024
8 checks passed

v1v deleted the feature/undeploy-kibana branch October 7, 2024 10:21

v1v added changelog:feature When you add a new feature and removed changelog:enhancement When you enhance an existing feature labels Oct 7, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: undeploy-my-kibana #140

feat: undeploy-my-kibana #140

v1v commented Oct 6, 2024 •

edited

Loading

v1v Oct 6, 2024

reakaleek Oct 7, 2024

v1v Oct 7, 2024

reakaleek Oct 7, 2024

v1v Oct 7, 2024

v1v Oct 6, 2024

v1v commented Oct 7, 2024

v1v commented Oct 7, 2024

v1v commented Oct 8, 2024


		### Further details

		Caused by @${{ env.PR_AUTHOR }} in https:/${{ env.REPO }}/pull/${{ env.PR }}

feat: undeploy-my-kibana #140

feat: undeploy-my-kibana #140

Conversation

v1v commented Oct 6, 2024 • edited Loading

What

Further details

v1v Oct 6, 2024

Choose a reason for hiding this comment

reakaleek Oct 7, 2024

Choose a reason for hiding this comment

v1v Oct 7, 2024

Choose a reason for hiding this comment

reakaleek Oct 7, 2024

Choose a reason for hiding this comment

v1v Oct 7, 2024

Choose a reason for hiding this comment

v1v Oct 6, 2024

Choose a reason for hiding this comment

v1v commented Oct 7, 2024

v1v commented Oct 7, 2024

v1v commented Oct 8, 2024

v1v commented Oct 6, 2024 •

edited

Loading