Use bot token to create org hook

[heurtematte]

Stop relying on eclipse webmaster token to create orgs hook but on bot token permission.
This means adding a new permission to bot token: admin:org_hook

[fredg02]

From a security standpoint, this is a good idea, but it will require a lot of manual effort to add the admin:org_hook permission to every bot token. Also, bot tokens expire automatically if they have not been used in more than a year.

Unless there is an easier way to deal with bot token creation, it's going to be a -1 from me.

[heurtematte]

it will require a lot of manual effort to add the admin:org_hook permission to every bot token.

Not necessary only apply to new bot creation.

Also, bot tokens expire automatically if they have not been used in more than a year.

I don't see any relation with this specific permission, it affects token in general.

I really want to avoid this code: https://github.com/eclipse-cbi/ci-admin/pull/24/files#diff-8cec566c9498b286ab6c717c83aa85b4a580f137fdaa032ae26cb799fd7f76cfL20

Storing an eclipsewebmaster token in cbi local pass.

[fredg02]

Not necessary only apply to new bot creation.

How do we set org level webhooks with existing bot token?

I don't see any relation with this specific permission, it affects token in general.

Yes, it affects token in general. So far, we don't rely on them though. So we can still set org level webhooks, even if a bot token expired.

[heurtematte]

How do we set org level webhooks with existing bot token?

looking at the code and IIRC, this is already set on old token by using the eclipsewebmaster token.

[fredg02]

looking at the code and IIRC, this is already set on old token by using the eclipsewebmaster token.

Old bot tokens only have admin:repo_hook not admin:org_hook. And org level webhooks have not been set for all orgs yet.

[netomi]

You could add a check if the token has the appropriate scope:

has_scope="$(curl -sS -f -I -H "Authorization: token ..." https://api.github.com | grep "^x-oauth-scopes" | grep "admin:org_hook" | wc -l)"

if [ ${has_scope} != "1" ] then
  # use webmaster token
fi

and if the token has the scope, use it, otherwise fallback to the webmaster token.

[fredg02]

Sounds good. @heurtematte can you add Thomas' suggestion?

[heurtematte]

I finally decided to do it differently.

The token can have the all scope needed but this doesn't mean that the token can access the org or the repository.

I choose to test first with bot token then with cbi config token.

[fredg02]

@heurtematte you did not want to check if the token has the admin:org_hook scope?

[heurtematte]

I just realized I've had messages pending for weeks now...

With the refactor code, I don't see the need to test the scope.
The logic is: Create the webhook first with the token bot account. If it fails, it falls back to the cbi config file token.

[heurtematte]

In addition, the code has been refactored.

[heurtematte]

@fredg02 gentle ping 🙂