Skip to content

Use custom Github App to authenticate backport job #10394

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 18, 2025

Conversation

cdce8p
Copy link
Member

@cdce8p cdce8p commented May 18, 2025

Followup to #10390

For organizations it's recommended to use custom Github Apps over PAT from bot accounts.
Created https://github.com/apps/pylint-backport-bot for it.

https://github.com/actions/create-github-app-token

@cdce8p cdce8p added Maintenance Discussion or action around maintaining pylint or the dev workflow Skip news 🔇 This change does not require a changelog entry backport maintenance/3.3.x labels May 18, 2025
@cdce8p cdce8p requested a review from Pierre-Sassoulas May 18, 2025 17:31
Copy link
Contributor

🤖 According to the primer, this change has no effect on the checked open source code. 🤖🎉

This comment was generated for commit 0033c58

Copy link
Member

@Pierre-Sassoulas Pierre-Sassoulas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is even better :) Is the app just an empty shell with some rights ? Otherwise where's the code for it ?

@DanielNoord
Copy link
Collaborator

Thanks @cdce8p for some of the recent PRs. Always good to have you around here 😄

@cdce8p
Copy link
Member Author

cdce8p commented May 18, 2025

Is the app just an empty shell with some rights ? Otherwise where's the code for it ?

Exactly. We somehow need to move beyond the GITHUB_TOKEN permissions. To do that the actions/create-github-app-token action authenticates the APP with the secret private key and get's an installation access token from it.

You can view the requested permissions here, but they are just the three explicitly listed in the backport.yml file. https://github.com/organizations/pylint-dev/settings/apps/pylint-backport-bot/permissions

Technically speaking the installation access token could have a slightly broader access than the PAT as it could be configured to access other org repos as well (i.e. astroid). That's one of the main use cases for it, to do inter org stuff. That config isn't the default though. https://github.com/actions/create-github-app-token?tab=readme-ov-file#owner

@cdce8p cdce8p merged commit 6be8676 into pylint-dev:main May 18, 2025
34 of 35 checks passed
@cdce8p cdce8p deleted the backport-github-app branch May 18, 2025 20:55
pylint-backport-bot bot pushed a commit that referenced this pull request May 18, 2025
cdce8p added a commit that referenced this pull request May 18, 2025
(cherry picked from commit 6be8676)

Co-authored-by: Marc Mueller <30130371+cdce8p@users.noreply.github.com>
Pierre-Sassoulas added a commit that referenced this pull request Aug 9, 2025
…10487)

* [ci] Install pylint before every test (#10388) (#10389)

Co-authored-by: Marc Mueller <30130371+cdce8p@users.noreply.github.com>

* Improve backport job permissions (#10390) (#10391)

(cherry picked from commit 222ab20)

* Resolve `possibly-used-before-assignment` false positives from `match` block assignments (#10393)

(cherry picked from commit ad14b5b)

* Use custom Github App to authenticate backport job (#10394) (#10396)

(cherry picked from commit 6be8676)

Co-authored-by: Marc Mueller <30130371+cdce8p@users.noreply.github.com>

* Fix Pyreverse: Aggregations aren't filtered according to filter mode (PUB_ONLY, etc.) (#10379) (#10401)

* updated diagrams.py file

* added tests

* updated tests

* added test cases

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

---------


(cherry picked from commit ed59632)

Co-authored-by: pavan-msys <149513767+pavan-msys@users.noreply.github.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

* Fix Mermaid printer rendering double underscores as bold formatting (#10403) (#10410)

(cherry picked from commit 25a0f9e)

Co-authored-by: Julian Grimm <51880314+Julfried@users.noreply.github.com>
Co-authored-by: Pierre Sassoulas <pierre.sassoulas@gmail.com>

* Respect docstring-min-length in docparams extension (#10104) (#10434)

(cherry picked from commit 7f5e996)

Co-authored-by: Berker ŞAL <brkr.sal@gmail.com>

* Fix `unused-variable` false positive when using same name for multiple exceptions (#10436) (#10481)

(cherry picked from commit 9e72867)

Co-authored-by: Zen Lee <53538590+zenlyj@users.noreply.github.com>

* Fix false-negative for used-before-assignment with postponed evaluation in function defs (#10482) (#10483)

(cherry picked from commit d363fca)

Co-authored-by: Marc Mueller <30130371+cdce8p@users.noreply.github.com>

* Update pytest-benchmark requirement from ~=4.0 to ~=5.1 (#10066) (#10484)

(cherry picked from commit f04761b)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump pylint to 3.3.8, update changelog (#10486)

---------

Co-authored-by: Marc Mueller <30130371+cdce8p@users.noreply.github.com>
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
Co-authored-by: pylint-backport-bot[bot] <212256041+pylint-backport-bot[bot]@users.noreply.github.com>
Co-authored-by: pavan-msys <149513767+pavan-msys@users.noreply.github.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Julian Grimm <51880314+Julfried@users.noreply.github.com>
Co-authored-by: Berker ŞAL <brkr.sal@gmail.com>
Co-authored-by: Zen Lee <53538590+zenlyj@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport maintenance/3.3.x Maintenance Discussion or action around maintaining pylint or the dev workflow Skip news 🔇 This change does not require a changelog entry
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants